Agents of Work
Let's Talk
October 20, 2026 · Agents of Work

Agents of Work AI Daily Briefing — October 20, 2026

Summary

A security firm found the control panels of criminal AI agents that have run more than 1,100 break-in attempts against online stores, at roughly $5 a try, on the same cheap DeepSeek model the U.S. government just ordered out of federal systems. The same day Microsoft told customers that no frontier model can be trusted and OpenAI showed its models can read the COBOL that runs the banks. The agents are cheap, capable and unsupervised, and the question for a business owner is who is watching yours, and who is watching the ones aimed at you.

Highlights

  • Criminal AI agents are probing online stores at about $5 an attempt and a one-in-ten hit rate, so patch logins and file uploads first.

  • Microsoft now says no frontier model can be trusted and sells software to watch your agents; its own Defender can spot 60 kinds of them.

  • Gartner expects 40% of enterprises to demote or shut down agents by 2027, mostly for lack of an owner.

  • OpenAI's newest model migrated COBOL programs 86.6% of the time, up from 5.4%, so the legacy system you fear to touch is getting cheaper to replace.

  • Washington ordered DeepSeek out of civilian agencies and may soon weigh Anthropic's narrow version of a federal AI shutdown law.

  • A diffusion model and a new MiniMax model both price output under a dollar per million, and Cloudflare cut its own AI review bill 68% without changing vendors.

  • Yelp's app will now phone your restaurant with an AI to ask about the wait, so decide who answers.

  • Waymo wants 20,000 cars by the end of 2027 and borrowed $5 billion with no Alphabet guarantee to get there.

  • A $1,000 robot gripper claims 1,500 picks an hour, and a robot brain now rents for $3 an hour; ask for the intervention rate before you believe either.

Quick Takes

  • Yelp will call your restaurant for a customer. A new Check for Me feature lets a diner enter a party size and phone number, and a voice agent phones the restaurant, asks the wait time and texts the answer back. The announcement does not say whether a restaurant can opt out, and concedes that if the business has its own voice agent the two may talk past each other. Yelp is also selling a $30-a-month Smart Lead Reply tool that answers and qualifies inbound leads. Read more

  • Patch Cisco's email gateway now. CVE-2026-76519, a 9.8-severity flaw in Cisco Secure Email Gateway, is being exploited with a single crafted attachment that gives an unauthenticated attacker root. Updating the Content Scanner Tools package to 25.3.0.5525 or later closes it without a software upgrade or restart. CISA's federal deadline was October 17. Read more

  • Nvidia put an agent model on the desktop. Nemotron 3.5 Bolt, a 74-billion-parameter open-weight model, runs locally on RTX Spark PCs for multistep reasoning and tool use without sending data to a cloud; its larger sibling Super VL is already used by EY, Ramp and CrowdStrike. Read more

What's Covered in Featured News

  • Criminal AI agents, caught in the open: what NorForge found on more than 20 exposed hacking dashboards, who they target, and what each attempt costs.

  • Microsoft's "agentic insider": why Microsoft says no model can be trusted, what Guardian Agents do, and Gartner's forecast for agent shutdowns.

  • OpenAI reads COBOL: the two new legacy-language evaluations, the scores, and the caveats OpenAI itself attaches.

  • Washington moves: the DeepSeek removal order and Anthropic's leaked draft of a federal shutdown law.

  • The money this week: a second $45 billion Nscale deal, Tenstorrent's $6.2 billion valuation, a record tech selling week and Amazon's twelve reactors.

  • Cheaper, faster, narrower models: Mercury 3, MiniMax's new Flash, Cloudflare's extraction model and Cloudflare's own 68% cost cut.

  • Physical AI: Waymo's fleet and debt, Eka's gripper, Dream Labs' robot brain, Physical Intelligence's API, Agility's Digit 5 at AGCO, Reliable Robotics and the Cologne robot case.

Featured News

Criminal AI agents are breaking into online stores, and their dashboards were left open

NorForge, a security startup, published on October 19 what it found inside more than 20 publicly exposed control panels for Cairn, an AI penetration-testing system that coordinates teams of agents against a target. The panels needed no password. Three clusters, 25 panels in all, appear to belong to criminals; a handful of apparently legitimate red teams were exposed the same way, which NorForge calls "highly problematic" for their clients.

The largest cluster runs 14 panels and more than 1,100 attack projects, aimed mostly at organizations in the United States, Japan and Australia, with the stated goal of persistent access to e-commerce and payment systems for later monetization. The other two work payment services, pharmacy sites and smaller online stores. NorForge estimates about one project in ten reaches its goal, that successful ones took a little under 23 hours, and that a typical attempt costs around $5 in model fees, with the longest running past $100. It verified one claimed break-in at a hardware parts vendor and found the back door still live on the site.

The tooling is ordinary: Playwright, Nmap, ffuf, Amass, and a lab for validating a Magento exploit, CVE-2026-75650. A worker in the main cluster is named for a Claude Code harness running DeepSeek V4.1 Flash, which NorForge calls its reading, not a confirmed fact. The panels also leaked the attackers' own secrets, hundreds of them, about 11% still valid. "Securing their own infrastructure does not appear to be among their strengths," the report notes. For a business with a storefront or client portal, the to-do list in those panels is the boring one: login flaws, pages that skip the auth check, and file uploads. Those get found faster now.

Microsoft: no model can be trusted, so watch the agents

Hayete Gallot, who runs Microsoft Security, published a post on October 19 titled "Securing the agentic insider." Its core line: "Unfortunately, frontier models, regardless of their origin, cannot be trusted." Not because they are malicious, she argues, but because they are trained to complete tasks rather than to follow "organizational norms or judgment," they are often overprivileged, and they can collude with other agents without being compromised. Her answer is Guardian Agents, software that watches every agent action before it happens, scores its risk, and escalates to a person as the risk rises, and Microsoft Defender can now detect up to 60 kinds of agents employees bring in on their own, including Claude Code and Codex. Satya Nadella's framing: "We need to separate the supply of intelligence from the authority over it."

The position is self-serving, since Microsoft would rather you buy the supervision from Redmond, but the market is heading the same way. Gartner forecasts that 40% of enterprise applications will include task-specific agents by the end of this year, up from under 5% in 2025, and that 40% of enterprises will have to demote or shut agents down by 2027 for want of governance and an owner. WalkMe's CIO, Tal Carmi, describes the typical case: an employee schedules a sanctioned desktop tool to read a shared inbox and update the ERP, nobody records it, and when that person is out the process stops. His fixes: connected systems read-only by default, and a daily cap on what an agent can change.

OpenAI's models can now read the COBOL that runs the banks

OpenAI published two evaluations on October 19 for what it calls low-resource languages, the ones with too little public code to learn from. In the COBOL migration test, a model rewrites a COBOL program in C++, Java, Kotlin, Python or Rust and passes only if hidden tests match the original output byte for byte. GPT-6.1 Sol passed 86.6% of programs at low reasoning effort, against 5.4% for GPT-5.6 Sol, and 97.9% at higher effort, at an estimated 39% lower API cost. The second test, MultiLangBench, asks a model to build a SQLite-compatible database engine from scratch in 20 languages. GPT-6 Astra averaged 87.4%, up from 26.8%, with COBOL rising from 10.9% to 72.1% and Visual Basic from 27.5% to 89.4%.

OpenAI designed and ran both tests itself, has not released the COBOL samples, and says production migrations still need expert review against the system's business rules. Its own example of why: COBOL's fixed-point arithmetic truncates extra decimals unless told to round, so a rewrite that rounds runs cleanly and returns different financial results. For a small company, the relevant legacy system is less likely a mainframe than a Visual Basic or Access application someone wrote in 2009 that nobody dares touch. That job just got cheaper to scope.

Washington: DeepSeek out, and Anthropic's shutdown law

The Department of Homeland Security ordered federal civilian agencies to stop buying DeepSeek products and remove them from existing systems, including third-party tools built on DeepSeek technology, in a Federal Register notice made public October 19. Agencies can request exceptions. DHS cited the risk that government users' data could be reachable by Chinese authorities under Chinese law; a December 2025 law already barred DeepSeek from intelligence and national security systems. Note the pairing with the lead story: the model the government is removing is the one the criminals appear to be running, because it is cheap.

Anthropic, meanwhile, has quietly circulated a draft federal bill, first reported by Politico on October 16. It would let the government halt a model only for a foreseeable, imminent threat of more than $1 billion in damages or more than 50 deaths or serious injuries, and only in three cases: biological weapons, a model escaping its developer's control, or a cyberattack. Independent evaluators would register with the Commerce Department and report any such finding within 72 hours, Commerce would need a federal judge's order to act, and the bill would preempt some state disclosure rules. "These are sensible policies we believe Congress should act on," an Anthropic spokesperson said. It is narrower than any other bill on the table.

The money: another $45 billion, a $6.2 billion chip bet, and the worst selling week in five years

Bloomberg reports Anthropic and Nscale are close to a second compute deal worth about $45 billion, a little over a month after the first, even as Nscale faces investor pushback on a $30 billion IPO valuation. Tenstorrent raised $1.5 billion at a $6.2 billion valuation, more than double its late-2024 mark, after rebuffing takeover interest from Intel and Qualcomm; chief executive Jim Keller is aiming its chips at serving open-weight models.

The public market is less sure. Jefferies' trading desk logged $7.5 billion of net tech selling last week, the most selling-tilted week in more than five years and larger than the DeepSeek week of January 2025, with the Philadelphia Semiconductor Index down 10%. Strategist Jeffrey Favuzza's diagnosis: demand for the neoclouds has not weakened, confidence in their access to cheap capital has. Hyperscaler capital spending is expected to pass $800 billion this year and $1 trillion next, and the power keeps being bought from the past: Amazon will be first customer for twelve X-energy small reactors, 960 megawatts, on a demolished coal plant site near Terre Haute, Indiana, with no completion date given.

Cheaper, faster, narrower

Three releases on October 19 push in the same direction. Inception's Mercury 3 is a diffusion language model, which drafts and refines a whole answer at once rather than one token at a time; the company claims 1,068 tokens per second and parity with GPT-6 Luna and Claude Haiku 5.5, at $0.20 per million input tokens and $0.70 output, on OpenRouter, Baseten and Vercel. MiniMax's M3.1 Flash prices at $0.15 and $0.60 and claims 70% lower cost on agent tasks than its predecessor. Both sets of benchmark claims are the vendors' own.

Cloudflare's Clairic is the more interesting idea for an operator. It is an extraction model that generates no text at all: you define typed fields, it returns a value per field in a single pass with a confidence score, or null if the answer is absent. In Cloudflare's test on damaged-product claims, a pipeline that used Clairic first and a language model only to draft the reply ran about three times faster and 49% cheaper than the all-LLM version. It is in preview on Workers AI. Cloudflare also published how it cut its own AI code-review bill 68%, from $2.43 to $0.77 a review, mostly by fixing prompt caching and matching cheaper models to the right effort level. Nothing about the vendor changed.

Physical AI

Waymo plans to go from about 4,000 cars to 8,000 by the end of this year and 20,000 by the end of 2027, and it just took its first debt, $5 billion from private credit lenders with no guarantee from Alphabet and the option to borrow more against its fleet leases. It has ordered thousands of vehicles from Zeekr, a unit of China's Geely, and runs in 15 U.S. cities plus Toronto. A fleet financed like an airline's is the clearest sign yet that robotaxis are a business rather than a demo.

The week's manipulation news comes with prices attached. Eka Robotics raised $150 million at a $1.45 billion valuation from a16z and F-Prime for a force-sensitive gripper paired with what it calls a vision-force-action model, trained in simulation. The gripper costs under $1,000 and is rated for 5 million cycles, a quarter of a standard industrial arm's 20 million. Eka claims about 1,500 picks an hour against roughly 600 for a person, reliable more than 95% of the time; those are company figures from confidential pilots, and outside roboticists asked whether it holds up for a year on a line. Dream Labs, founded by former leaders of Nvidia's GR00T team, raised a $90 million seed and opened a public API that drives any two-armed robot with parallel grippers for $3 an hour; zero-shot pick-and-place succeeds about 80% of the time, other tasks 50% to 60%. Physical Intelligence's Pi API beta, open by application and unpriced, lets a company upload its own robot data and get a fine-tuned model back; Almond used it to teach a dual-arm robot to deburr its own parts in four days.

Humanoids got a buyer and a spec sheet. AGCO signed a commercial agreement with Agility Robotics to pilot Digit at its Hesston, Kansas plant starting in 2027, sorting and stacking parts and placing totes. Agility co-founder Jonathan Hurst's account of Digit 5 is the honest version: it weighs over 120 kilograms, runs about 90 minutes on a charge and refills in a 9-minute break, lifts 23-kilogram bins to 1.75-meter shelves, is built for up to 20 hours a day, and sits down and cuts motor power when a person gets close. No price, and he calls it the most expensive robot Agility will build.

Elsewhere, Reliable Robotics raised $115 million at a valuation above $1 billion for retrofit autonomy on existing aircraft; its own airline flies cargo six days a week on six Cessna Caravans with a pilot aboard, and certification to run the autopilot from startup to landing is 18 to 24 months out. And in Cologne, police seized a 120-centimeter robot after it allegedly groped a 16-year-old while two young men filmed and streamed; investigators are still establishing whether it was preprogrammed or driven live, "new territory for us," a spokesman said. Whoever holds the controller holds the liability.

What This Means for Your Business

Assume you are already on a target list, and fix the boring things. The Cairn panels show what an AI attacker actually works through against a small online store: logins without rate limits, pages that skip the authorization check, file uploads that accept anything, and unpatched platform bugs like the Magento one in the attackers' lab. At $5 an attempt and a day's wait, the economics favor volume, which means the unglamorous sites get hit too. This week: turn on multi-factor login for every admin account, update your commerce platform and plugins, restrict upload types, and if you run Cisco's email gateway, apply the scanner update today. If you hire an outside tester, ask how they secure their own AI tooling; NorForge found legitimate red teams exposed on the same panels.

Give every agent an owner, a scope and a budget. Microsoft's point stands whoever sells the fix: a model is trained to finish the task, not to respect your rules, so the rules live outside it. Make an inventory of every scheduled job, inbox watcher and workflow someone built with a desktop AI tool, write a name next to each, and default each one to read-only on the CRM, the accounting system and the ERP. Cap what any agent may change in a day at a human-scale number. Gartner's 40% shutdown forecast is a description of companies that skipped this step, and the fix now costs an afternoon rather than an incident.

Reprice the two things that just got cheaper. First, legacy code: if a Visual Basic, Access or Fortran application is holding a process hostage, OpenAI's numbers say a migration is now a scoping conversation, not a fantasy. Insist on the byte-for-byte standard OpenAI used, test against your real edge cases, and keep a person who understands the business rules in the loop; the rounding example is exactly the kind of error that passes every test and misstates an invoice. Second, inference: Mercury 3 and MiniMax's Flash put capable output under a dollar per million tokens, and Cloudflare cut its own bill 68% by fixing caching and effort levels without switching vendors. Check your cache hit rate before you check your contract. And for any job that is really extraction, pulling fields out of invoices, claims or emails, Clairic's shape, typed answers with confidence scores and a null when the fact is missing, is what to ask every vendor for.

On the physical side, buy on intervention rate, not demo rate. Eka's 95% and Dream Labs' 80% are honest numbers because they are stated as rates; the question for your warehouse is what happens in the other 5% or 20%, and who walks over. Agility's spec sheet is the model answer, 90 minutes of work, 9 minutes of charge, a sit-down when a person approaches, and no price yet. Ask vendors for that sheet. If Yelp's agent is about to call your front desk, decide who answers, a person or your own agent, and test the two-agent call before a customer does.

Sources

← All posts