Morning Brief, October 23rd 2026
Microsoft traced automated intrusions through a compromised backup service. METR published holes in OpenAI’s summer monitoring. Treasury proposed wider outbound-investment restrictions. Walmart announced separate shopping profiles for , with spending limits and purchase approval enabled by default.
Microsoft traces automated intrusions to a compromised backup service
Microsoft says the China-aligned group Storm-0940 used its ARTEX agent framework against hundreds of organizations, sometimes reaching privileged access in under three hours. Its October 21st report describes a compromised ConnectWise Cloud Backup application whose existing permissions gave attackers a route into customer environments. More than 2,250 tenants were targeted; that is not a count of successful breaches.
The economic advantage is reuse: one trusted supplier connection gives an automated attacker many doors to try. Microsoft attributes the campaign, but does not identify a Microsoft product vulnerability. Successful authentication alone does not establish data theft. SourcesA
METR publishes the holes it found in OpenAI’s summer monitoring
METR published an audit yesterday of OpenAI's July system, finding ways agent activity could evade monitoring, including around compressed conversation histories and unfinished turns. The historical qualification matters: this is not a fresh assessment of the system running today.
OpenAI says the production-relevant problems were patched. METR has not independently verified that claim. The audit makes the distinction between installing a monitor and establishing that it sees the work unusually concrete. An external retest of the repaired system would answer the remaining question. SourcesA
Treasury proposes a wider net for outbound technology investment
The Treasury Department proposed rules yesterday to implement the and expand its outbound-investment security program. The proposal reaches beyond its existing semiconductor, quantum and AI scope into areas including hypersonics, supercomputing and biotechnology.
Investors have a proposed compliance perimeter to study, not a new final rule already in force. The distinction affects when deals must change. Public comments and the final implementation still stand between this announcement and binding requirements; treating the proposal as an immediate investment ban would overstate what happened. SourcesA
Four agent projects move into the Agentic AI Foundation
The Agentic AI Foundation added Anthropic's , OpenAI's Open Responses, 's OpenEnv and Alibaba's OpenSandbox yesterday. They address reusable instructions, model-interface conventions, training environments and isolated execution respectively.
Putting these pieces under shared governance gives developers a possible route around maintaining a separate integration for each supplier. It does not establish that implementations are interchangeable or secure. Alibaba's contribution also makes the open agent infrastructure story broader than the US labs competing over the applications built on top. SourcesA
Carbon-X brings raw DNA and language into one open model
Hugging Face Bio released Carbon-X, a DNA-and-language model built on Qwen3-14B with collaborators including Zhongguancun Academy. The model accepts sequence data and natural-language questions rather than requiring a separate specialized interface for each biological task. Its carry an license.
That gives researchers a downloadable starting point for experiments combining genetic sequence and explanation. The 's results are author evaluations, not evidence that its answers can guide patient care. The release matters as research infrastructure; clinical usefulness needs a different test. SourcesA
Recursive releases Flint for local coding agents
Recursive introduced Flint on October 21st, an open coding model with 40 billion total and 2.5 billion active at a time. The company reports more than 125 per second on an M4 Pro, a vendor measurement whose task and configuration matter.
Recursive says its automated research system helped develop the model. That claim does not isolate how much progress came from automation rather than the researchers directing it. Downloadable weights make the useful part testable: whether a local coding agent can finish the reader's own work at an acceptable speed. SourcesA
Walmart prepares separate shopping accounts for agents
Walmart announced Agent Profiles on October 21st, with spending limits, revocable access and purchasing history separated from ordinary shopping. The profiles are due within a month; an agent gateway for developers and businesses is also headed toward beta. Purchase approval is the default.
The retailer is defining who grants permission before agents start spending. Existing return policies will apply to mistakes. That puts a familiar customer remedy behind an unfamiliar purchasing interface, though the announced controls still need to survive actual shopping behavior. SourcesA
Uber takes ChatGPT Work from a pilot to the company
Uber announced yesterday that ChatGPT Work will reach more than 30,000 employees after a roughly 1,000-person pilot. The rollout includes approved integrations, employee training and internal skills, with Sol as the default model.
This is a deployment commitment, not a measured productivity result. Uber says it plans to share outcomes later. The useful follow-up will separate access from regular use and completed work from generated material; the license count alone cannot tell investors whether the program earns back its cost. SourcesA
Google Cloud adds an Anthropic-managed route to Claude
Google Cloud announced of Anthropic-managed Claude today alongside its existing Google-managed option. The new route offers access to Anthropic platform features and new models as they arrive, while retaining Google Cloud billing.
The choice changes who processes the data and which platform controls apply. Customers wanting Google's management and governance features still have the other route. Procurement teams should compare those responsibilities before treating the two offerings as the same service with different labels. SourcesA
Google explains how Agent Compute Engine keeps credentials outside the guest
Google detailed Agent Compute Engine's isolation design: agent code runs inside hardware-isolated , while a separate gateway authorizes access to outside services. Long-lived stay outside the guest; short-lived identities mediate requests. Idle environments can preserve their state while releasing compute.
The design attacks a specific failure mode, an agent reading a powerful credential from its own workspace. Google's architecture description is not an independent security evaluation, and isolation does not decide whether an otherwise authorized request is a good idea. SourcesA
Microsoft tests diagnostic AI on retrospective cases
Microsoft published research yesterday on its MAI-DxO diagnostic system, including difficult published cases and retrospective emergency-department records. It reports higher diagnostic accuracy and lower test costs than its physician comparison groups under the study's conditions.
Retrospective records let researchers compare decisions against known outcomes. They do not reproduce the consequences of deploying a system with live patients, incomplete observations and clinical responsibility. The result supports further prospective evaluation; it does not establish that a hospital can safely replace its diagnostic workflow. SourcesA
Canva ships Craft with a route from generated images to editable designs
Canva launched Craft through Dream Lab and its public . The image model separates planning a composition from rendering it, while Magic Layers can turn generated designs into editable elements. Access extends across Canva's subscription tiers.
Editable output matters because a useful draft still needs a corrected price, a translated label or a moved logo. The editing step is a separate product capability, not proof that every generated image arrives as a clean document. Faster variants and an integration remain forthcoming. SourcesA
AWS makes custom training sessions available without managing GPUs
AWS made SageMaker AI training sessions generally available, letting developers supply custom training logic while the service manages the . Billing follows processed tokens and pauses while external reward calculations run; checkpoints can remain in the customer's S3 storage.
That removes infrastructure work from experiments where a developer supplies feedback for a model to learn from. It does not remove the cost of producing trustworthy feedback. The practical comparison is the full cost of an experiment, including data and evaluation, against renting and operating the hardware directly. SourcesA
Agility puts Nvidia’s Thor at the center of Digit 5
Agility Robotics expanded its Nvidia partnership yesterday and selected IGX Thor as the exclusive onboard computing platform for Digit 5. Initial availability is planned for the first half of 2027, with broader availability later.
Agility also describes safety work and preparation for third-party certification. Preparation is not certification, and a commercial schedule is not a delivered fleet. The supplier commitment makes the next robot easier to specify; customers still need evidence of safe operation and useful uptime in their own facilities. SourcesA
OpenAI and Poland’s NASK sign an AI safety agreement
OpenAI and Poland's signed an agreement announced today to explore work on AI safety, security research and evaluation. NASK is a Polish public research institute with national cybersecurity responsibilities.
The agreement adds a public institution to OpenAI's research relationships. It does not announce a completed independent audit or a new regulatory approval. Its value will depend on the work the partners publish and whether outside researchers can inspect the results. SourcesA
US lawmakers propose voluntary defenses against hostile model distillation
Representatives Pat Harrigan and George Whitesides are advancing an AI Cyber Defense Act that would direct to develop voluntary standards against adversarial model , CyberScoop reported yesterday. The proposal targets extraction associated with adversaries including China and Russia.
Distillation can also be a legitimate way to train a smaller model from another model's outputs. The policy question is how standards distinguish permitted development from unauthorized extraction. This is proposed legislation, not an enacted requirement or a ban on the technique itself. SourcesB
Watchtower raises $35 million for military logistics software
Watchtower Labs raised $35 million in seed funding led by Shield Capital and Conviction, GeekWire reported on October 21st. Founded by former Marine Akhil Iyer and Microsoft veterans Souren Aghajanyan and John Morman, it uses AI to help users query and simulate military logistics.
The company has a Defense Innovation Unit prototype contract. That is a route into testing, not evidence of deployment at production scale. The commercial question is whether operators will trust a model's representation of supplies and routes when real-world information is late or contradictory. SourcesB
Google’s ForTy maps what kind of forest is disappearing
Google DeepMind, the World Resources Institute and IIASA presented ForTy2020 yesterday, mapping six forest and land-use classes at 10-meter resolution. An early annual series extends from 2017 through 2025.
The distinction matters when tree cover persists but a natural forest has become a plantation. A cover-only count can miss that change. These maps can help target investigation, but classification from imagery does not by itself establish ownership, legal compliance or the cause of a loss. SourcesA
A robot stress test finds the apparent planner gap depends on the fault
The Alpha , submitted on October 21st, compares scripted and language-model planners under injected failures in simulation. Across all tested faults, success was 64% for the scripted planner and 44% for the language-model planner. Excluding corruption of planner output, both scored 55%.
That is a warning about the test as much as the planner: a fault aimed at one interface can dominate the comparison. The author results do not establish a general ranking of robot intelligence.
PiHand transfers learned hand motion across simulated tasks
The PiHand preprint, submitted yesterday, learns a shared representation of hand and object motion from expertise, then uses it to train manipulation skills. The researchers report transfer to tasks including catching and handovers, with unfamiliar objects.
Reusing a motion prior could reduce the work required to teach each task from scratch. The evidence is from simulation. The project promises code and checkpoints; that promise should not be counted as an available release or as a demonstration on physical hardware. SourcesA
Editorial
The expensive part of an agent is the authority it inherits. A supplier connection can expose customers to automated intrusion; a shopping account can authorize purchases. In both cases the business has to decide where permission stops before counting the labor it expects to save.
My bet is that bounded authority will sell before broad autonomy earns trust. That favors products with separate credentials, explicit spending limits and a usable remedy when something fails. I would change my mind if comparable deployments showed that broader authority delivered persistent net savings after incidents, recovery and supervision were counted. A faster demonstration cannot answer that question. SourcesAA
Prediction Watch
No change: Nobody solves (Prediction 2026-08-06-T4). Google's isolated execution and external credential controls limit what an agent can reach; its architecture disclosure does not establish the independently tested, broadly adopted defense this call requires. Settles August 6th 2027. SourcesA
Nothing settled today. No reviewed open call is past its deadline.
Sources
- Microsoft traces automated intrusions to a compromised backup service A
- METR publishes the holes it found in OpenAI’s summer monitoring A
- Treasury proposes a wider net for outbound technology investment A
- Four agent projects move into the Agentic AI Foundation A
- Carbon-X brings raw DNA and language into one open model A
- Recursive releases Flint for local coding agents A
- Walmart prepares separate shopping accounts for agents A
- Uber takes ChatGPT Work from a pilot to the company A
- Google Cloud adds an Anthropic-managed route to Claude A
- Google explains how Agent Compute Engine keeps credentials outside the guest A
- Microsoft tests diagnostic AI on retrospective cases A
- Canva ships Craft with a route from generated images to editable designs A
- AWS makes custom training sessions available without managing GPUs A
- Agility puts Nvidia’s Thor at the center of Digit 5 A
- OpenAI and Poland’s NASK sign an AI safety agreement A
- US lawmakers propose voluntary defenses against hostile model distillation B
- Watchtower raises $35 million for military logistics software B
- Google’s ForTy maps what kind of forest is disappearing A
- A robot stress test finds the apparent planner gap depends on the fault A
- PiHand transfers learned hand motion across simulated tasks A