Morning Brief, October 8th 2026

Editorial

A completed request is a poor unit of trust.

The silent-tool-failure study gives that objection a measurable shape. A well-formed wrong answer was harder for agents to recognize than an explicit error. The memory study locates another failure before generation: a model can faithfully repeat a fact that should no longer be in its input. Neither problem disappears because the final paragraph reads well. SourcesAA

My position: teams building unattended agents should spend their next evaluation cycle corrupting inputs and interrupting execution. The useful questions are whether the agent notices, whether the application preserves its obligations, and whether the final action remains justified. A clean benchmark run provides too little evidence about those conditions.

RunningTab supplies one concrete design to test. Requirements and unopened files remain in an external record, so the agent's declaration of completion can be compared with something that survives the conversation. Pinrail addresses a different stage by presenting proposed actions for review. Its own documentation says the agent decides when to ask. The review interface therefore earns trust only for the proposals that actually reach it. SourcesAA

This argument would weaken if independent trials showed that stronger models reliably identify plausible corrupted tool values, resolve stale memory and preserve unfinished obligations without those external mechanisms. Today's papers do not show that. Their results are narrow, but the failure modes are concrete enough to reproduce before assigning an agent more authority.

The parallel run's editorial, on the same byline:

The default role is the vulnerability. By Vera Lindqvist.

Three of this morning's stories are the same story. Zenity talked one public agent on Bedrock AgentCore into handing over credentials that unlocked every other agent in the account. Pwn2Own's new AI infrastructure category produced a reverse shell on LiteLLM inside a day. And a single attacker ran ARTEX, a free tool driving three open-weight models, through multiple Korean banks. None of this required a frontier capability. Each one worked because the layer around the model was built the way software was built before agents: trusted by default, broad by default.

Look at the component the Zenity chain actually rests on. Not the model; the model did what any obedient instruction-follower does. The load-bearing piece is AgentCore's default execution role, one IAM policy that granted every agent in an account read, write and delete over every other agent. AWS narrowed it in August, roughly eight months after the report, while shipping a policy engine for everyone else's agents in the meantime. OpenAI fixed its comparable flaw in four days. The gap between those two numbers is the cost of treating isolation as a feature rather than the product.

My claim: through at least next year, the agent breaches that matter will be boundary failures, in defaults, roles and metadata services, and the vendors' own advisories will say so. A major incident whose root cause is genuinely a model making a bad decision inside a correctly scoped boundary would prove me wrong. The telling detail is that nobody at Pwn2Own bothered attacking a model. The prize money went to input validation. Attackers price capabilities honestly, and their price list says the walls are worth more than the mind. SourcesAAB