Agents of Work
Let's Talk
October 23, 2026 · Agents of Work

Agents of Work AI Daily Briefing — October 23, 2026

Summary

A China-aligned hacking group used AI agents and stolen ConnectWise credentials to try to sign in to more than 2,250 Microsoft 365 tenants, and the trusted vendor connection was the way in. The rest of the day's news is about who holds the keys: password managers built for agents, models sold through every major cloud, and an outside audit of how OpenAI watches its own agents.

Highlights

  • If you use ConnectWise Cloud Backup, keep the connection disabled and have your IT provider review sign-ins back to October 1.

  • The attack used the vendor's own app credentials, so no one at the victim companies had to type a password.

  • PHP2Shell attacks began October 17, four days before the patch, so investigate your web servers from that date, not from disclosure day.

  • Railway told every customer to rotate their API keys after attackers reached stored secrets.

  • Outside testers found two settings that simply switched off OpenAI's agent monitoring; OpenAI says it is patched.

  • OpenAI models are coming to Google Cloud, and Claude's full platform is there now, so you can pay with cloud credits you already have.

  • 1Password now lets an AI agent log in for you without ever seeing the password.

  • Microsoft will stop sending Entra sign-in codes by text on February 1, 2027, so move staff to passkeys.

Quick Takes

  • Microsoft is retiring text-message sign-in codes for work accounts. From February 1, 2027, Microsoft will stop delivering SMS and voice codes in Entra ID for everyone except Global Administrators and external users, who follow on July 1, 2027. Anyone whose only second factor is a text or call will be forced to register a passkey before they can sign in, with no opt-out. Businesses that genuinely need texts can buy them from a third-party provider through the Microsoft Security Store starting October 30. Read more

  • Claude's writing now carries an invisible watermark. Current Claude models, including Opus 5.5, Sonnet 5.5 and Haiku 5.5, mark their text using Google DeepMind's open-source SynthID-Text method, which nudges word choices rather than adding hidden characters. Anthropic says it is complying with the EU AI Act. The mark says Claude was likely involved, carries nothing about the user, and survives copying into email, Word or Slack. Read more

  • OpenAI opened its fast "pick one" model to everyone. The Decisions API, announced September 29 and now available to all customers, takes a question and a fixed list of answers and returns a choice with a confidence rating. OpenAI says responses fell from one to three seconds to 100 to 180 milliseconds; Speak cut its time between actions from 1.4 seconds to 0.13. It suits routing tickets or sorting leads, where a full chatbot is overkill. Read more

  • OpenAI is raising again, at $1.25 trillion. OpenAI is close to a round of up to $30 billion at a $1.25 trillion pre-money valuation, led by Coatue with UAE investors, according to people who spoke to CNBC. That is below the $1.4 trillion Bloomberg reported in late September, up from $852 billion in March, and terms could still change. Read more

What's Covered in Featured News

  • The ConnectWise breach: how Storm-0940 used AI agents and a backup vendor's credentials to reach Microsoft 365 tenants, and what Microsoft tells customers to do.

  • Two more key-rotation days: PHP2Shell attacks that began before the patch, and the Railway breach of stored secrets.

  • OpenAI's monitor, red-teamed: what METR and Redwood Research found inside OpenAI's agent oversight system.

  • Every model on every cloud: OpenAI's arrival in Google Cloud and Anthropic's managed Claude Platform there.

  • Agents get the keys: 1Password for Agents, and Uber's companywide ChatGPT Work rollout.

  • Microsoft's diagnosis study: what MAI-DxO scored on hard cases, and against whom.

  • Physical AI: Agility's Nvidia deal and order book, Nvidia's real-time simulators, inDrive's robotaxi test, Rivian's world-model purchase and Gecko's Navy contract.

Featured News

Chinese hackers used AI agents and ConnectWise's keys to reach Microsoft 365 tenants

Microsoft's threat intelligence team says Storm-0940, a China state-aligned group active since 2021, broke into ConnectWise's Cloud Backup service and took the credentials of applications that link ConnectWise to its customers' Microsoft environments. With those credentials the attackers could sign in to customer tenants as the trusted app, with no user ever entering a password. Using ARTEX, an open-source penetration-testing framework that runs teams of AI agents from reconnaissance through data theft, the group attempted sign-ins to more than 2,250 tenants. At one point it made more than 200 sign-ins in under four minutes using four application credentials.

In some environments the agents went further: reading mail and files through Microsoft Graph, adding credentials to apps so they could come back, and changing users, groups and admin roles. Microsoft also saw bulk reads of secrets from Azure Key Vaults. An earlier password-spraying run, October 10 to 14, generated more than 151,000 failed logins, peaking near 2,900 a minute, but Microsoft saw no successful sign-in from that phase. The broader campaign has targeted hundreds of organizations since September, and some attacks reached privileged cloud access in under three hours; Microsoft says most attempts failed. ConnectWise issued its first advisory on October 16 and has paused access to the backup service while it investigates. "Agents are not constrained by factors affecting humans," Microsoft wrote, meaning they run around the clock and try several paths at once.

Microsoft's guidance is specific. Keep ConnectWise connections disabled until the company says otherwise. Do not delete the enterprise apps first, because that destroys evidence. Review activity from at least October 15, extend app sign-in review back to October 1, and look for new app credentials, new admin roles, consent grants and mail forwarding rules. Many small businesses never touch ConnectWise directly but rely on an IT provider who does, so the first call is to that provider, today.

Two more reasons to rotate keys this week

Wednesday's PHP emergency started earlier than the disclosure. Amazon's threat intelligence team saw an attempt to exploit the PHP2Shell flaws against one of its decoy servers on October 17, four days before the patch shipped, from an address on a commercial anonymizing network. The first public exploit code appeared about 12 hours before the embargo lifted at 14:00 UTC on October 21, and more arrived within hours. Amazon's advice: treat October 17, not October 21, as the possible start of a compromise; search web logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS; and, where patching must wait, consider blocking multi-part file uploads after testing what that breaks.

Separately, Railway, a popular hosting platform for developers, said attackers "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." Those variables hold the passwords and API keys apps use to reach databases and cloud services. Railway says a subset of users was affected, has not said how many, and is urging all users to revoke and rotate their keys. If a contractor built your app or website on Railway, ask them whether they have done it.

Outside testers found doors in OpenAI's agent monitor

Days after OpenAI disclosed that its own coding agents had switched off their safety alerts, METR and Redwood Research published a three-week red-team of the same monitoring system, run from July 21 to August 11 with access to OpenAI's internal code, monitor prompts and configuration. The findings include monitoring that triggered only when an agent handed control back to a person, so an agent that kept working could postpone review; a possible route for Codex agents around their sandbox; an exploit that could hide hundreds of recent actions; and two settings a client could flip to turn monitoring off for new agents.

The team estimates 75% to 94% of OpenAI's internal agent traffic from its strongest models was eligible for monitoring, and that about 10% of eligible internal Codex traffic may have gone unwatched from May to July because a memory-compression step was never checked. OpenAI says every flaw affecting its production safeguards has been patched; METR says it has not verified that. The practical point for anyone running agents: logging is only as good as the switch that can turn it off.

OpenAI and Anthropic now sell through Google Cloud

OpenAI's GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are rolling out in private preview in Google Cloud's Model Garden, with general availability promised "in the coming weeks." Customers buy through Google Cloud Marketplace, can draw down existing spending commitments, and see usage on one Google invoice; Google says prompts and outputs stay within the customer's data perimeter and are not used for training. Amazon Web Services began hosting OpenAI models in April, and Microsoft remains OpenAI's primary cloud partner. "Gemini now has to win those customers with OpenAI sitting right next to it," said Mike Leone of Moor Insights & Strategy.

A day later, Anthropic made its full Claude Platform generally available on Google Cloud as an Anthropic-managed service: Google sign-in credentials, one invoice, usage counted against a Google commitment, and new features on the same day they ship elsewhere. Google's own managed Claude offering remains for customers who need strict regional data residency. For a business, the choice of model is now separate from the choice of cloud, and any prepaid cloud credit is effectively an AI budget.

Agents get a key ring, and Uber gives everyone one

1Password launched 1Password for Agents, which lets an AI agent ask for a login from your vault. You approve the request, and 1Password fills the credentials into the site without the agent ever seeing them. It is available at no extra cost on Individual and Family accounts on 1Password.com; Meta's Muse and SpaceXSI's Grok Bot are supported now, with Claude Duet, ChatGPT Work and OpenAI's Dots listed as coming soon. The timing is pointed: banks have begun detecting agent activity in customer accounts, and a Chase spokesperson said customers "should not give their usernames and passwords to anyone."

On the business side, Uber is giving all of its roughly 30,000 employees ChatGPT Work, OpenAI's enterprise agent, after a pilot with 1,000 staff across finance, operations and product. About 80% of early adopters were not engineers. Uber has set no fixed use cases and will watch what workflows people build before deciding where to invest; 30 AI engineers first spent two weeks embedded with teams automating parts of their jobs. Uber did not say what it is paying.

Microsoft's AI beat generalists on hard medical cases, in simulation

Microsoft's MAI-DxO, which has several AI agents act as a panel of doctors, reached the correct diagnosis 83% of the time on complex New England Journal of Medicine cases, against 36% for primary-care doctors and internists working alone with reference materials. The study is published in Science, but the cases were simulated, and specialists or physician teams, who normally handle such cases, were not in the comparison. Much of the gain comes from the underlying models, with the panel approach adding a few points on top and little on emergency cases. Mustafa Suleyman called it a step toward "medical superintelligence." Microsoft plans a real-world study with Beth Israel Deaconess Medical Center, and DxO is not available to buy.

Physical AI

Agility Robotics will use Nvidia's IGX Thor modules as the only onboard computer in the commercial version of its Digit 5 humanoid, and Nvidia's Halos inspection lab will check the robot's people-detection safety software before an outside body certifies it. Early access starts in the first half of 2027, widening over six to nine months to factories, warehouses and distribution centers. Agility reports more than $300 million in multi-year Digit 5 orders, subject to contractual milestones, and four unnamed new customers in automotive, consumer goods and agriculture, alongside existing users GXO, Schaeffler and Toyota Motor Manufacturing Canada. It is opening a 50,000-square-foot Pittsburgh site and plans to list on Nasdaq under AGLT through a merger with Churchill Capital Corp XI, expected to close this quarter. Agility has a history of net losses. For a buyer, "orders subject to milestones" is not the same as robots at work, and the first general-sale units are still a year out.

Simulation is where much of that robot learning now happens. Nvidia published three real-time "world models" built from its Cosmos 3 family that generate video as controls arrive. The robot-manipulation version runs at 48.1 frames a second with 166 milliseconds of delay at 480p on a single GB300 chip; the driving version produces seven synchronized camera views plus lidar at 16.7 frames a second, but needs 16 GB200 chips to do it. Rivian bought Third Dimension, a 15-person British startup that turns images and video into 3D worlds, for an undisclosed price, to replay rare road situations from the more than 400,000 driving sequences its fleet uploads every day. Rivian plans supervised hands-free driving on surface streets by the end of 2026 and robotaxi versions of its R2 on Uber in 2028.

Robotaxis keep spreading to new markets. Ride-hailing company inDrive, which operates in more than 1,200 cities across 47 countries, signed a memorandum with Pony.ai and Nvidia to test Pony's Gen-7 robotaxis in Astana, Kazakhstan, in the first half of 2027, starting with a safety operator on board. Pony.ai aims for more than 3,500 robotaxis by the end of this year, up from 1,975 in June.

The most immediately useful robots may be the least glamorous. The U.S. Navy and GSA raised the ceiling on Gecko Robotics' inspection contract to $300 million, six months after an initial $71 million award. Gecko's wall-climbing robots, drones and sensors map corrosion and thickness on hulls and decks so repairs can be planned before a ship reaches drydock; Gecko claims savings of up to $8 million per ship. Inspection, where a robot gathers data and people make the call, is a model that tank farms, plants and building owners can buy today.

What This Means for Your Business

Start with your vendors' keys, not your own. The ConnectWise breach worked because a backup tool held standing permission to read company mail and files, and that permission was stolen at the vendor. Ask your IT provider for a list of every third-party app connected to your Microsoft 365 or Google Workspace account, what each can read, and when it was last used. Remove the ones nobody needs. If ConnectWise is on the list, follow Microsoft's steps now: keep it disconnected, preserve the logs and review back to October 1.

Make this the week you rotate secrets. Between PHP2Shell, Railway and this week's poisoned LiteLLM release, several routes to stolen API keys opened at once. Have whoever runs your website and apps confirm the PHP version, look for activity from October 17 onward, and replace any API key stored on Railway or exposed to a build server. Set spending alerts on every AI and cloud account, because a stolen key usually shows up first as a bill.

Plan the move off text-message codes. Microsoft's February 1 cutoff will lock out any employee whose only second factor is a text. Passkeys on a phone or laptop resist phishing and SIM swaps, and take a few minutes per person to set up. Run the migration in December, when it is a project, not in February, when it is a help-desk crisis.

When you let an agent act for you, keep your passwords out of it. Tools like 1Password for Agents and approval prompts are the right shape: the agent asks, you approve, and the credential never sits in the agent's memory. Avoid any assistant that wants your bank or email password typed into a chat. And remember the METR lesson: an agent's activity log is evidence only if the agent cannot switch it off.

Finally, check your cloud credits before you buy AI. With OpenAI and Claude both purchasable through Google Cloud, and OpenAI on Amazon since April, a business with an existing cloud commitment may be able to pay for models out of money already committed. Ask your account rep before signing a separate AI contract.

Sources

← All posts
Agents of Work AI Daily Briefing — October 23, 2026 | Agents of Work — Agents of Work