The agents are outgrowing the tools built for people: Anthropic's merge volume broke Git, OpenAI's always-on assistant burned 300K tokens without a prompt, and npm's publishing trust model turned out to hinge on a repo name anyone could reclaim.

Today's headline

Agents are outgrowing the tools built for people. Anthropic's merge volume broke Git, an always-on assistant burned through tokens with nobody typing, and npm's publishing trust hinged on a repo name anyone could reclaim. Meanwhile OpenAI keeps retiring older models, so today is as much about migration as news.

On the clock

Today, GPT-5.5 leaves ChatGPT, ChatGPT Work and Codex. The API is not affected. If anything pins it in Codex, move it to gpt-5.6 Sol.

On Friday, October twenty-third, the OpenAI API shuts down a batch of older models, including o1, o3-mini and o4-mini. Nine days is not much time.

Then the longer runway. OpenAI set January fourteenth, twenty twenty-seven, as the API shutdown for the GPT-4o and GPT-4.1 families, mini versions included. Fine-tuned versions go on the same date. OpenAI names gpt-6 Luna as the replacement for all four, but says nothing about whether it behaves the same. Three months is a normal window to test and migrate. If you own fine-tunes, check now whether you can tune the successor at all.

Do this week: search your repos and gateway logs for the retiring model names, repoint the o-series before the twenty-third, and run your evals on gpt-6 Luna before you plan the January move.

Security

The lead is npm. Trusted publishing matched a repository by its name, not its numeric ID, until the first successful publish. So an attacker who re-registered a freed repo name could mint a valid publish credential for a package they don't own. The researchers who reported it count more than fifteen hundred exposed packages. There's no CVE, so scanners will stay silent. GitHub fixed the platform side on October second. Unvalidated bindings now expire, and publish tokens from issue comments are rejected. Maintainers still need to audit their own.

Do this week: audit every npm trusted-publisher binding you own by Friday. Recreate any whose repo was renamed, moved or deleted, and stop triggering publishes from issue comments.

SAP Cloud SDK for Python has a critical flaw, rated a perfect ten. It builds its token address from the tenant subdomain without checking it. Whoever controls that subdomain can redirect the request, client secret included, to their own server. Multi-tenant apps on SAP's cloud platform are the exposed shape. No exploitation is reported. Upgrade to a patched release, and avoid a short range of later releases that reportedly skip the check. If an untrusted party could ever set a subdomain, rotate the credentials.

Docker Hub closed a bug that ran for about two years. When an account was converted to an organization, its access tokens moved to whoever became owner, with no confirmation and no notice. Those tokens could push, pull and delete images as the original user. Docker found no evidence of abuse and fixed it on its side, so there's no client update. Docker emailed the exposed accounts. If you got no email, Docker says you weren't exposed.

Now the bugs that AI found. XBOW used agents running OpenAI's public GPT-5.6 Sol to build a full Chrome exploit chain. Loading a page was enough to run code on Windows outside Chrome's sandboxes. By XBOW's own figures, it took about forty thousand dollars of compute. XBOW says a state-level team once needed months for the same thing. Four researchers directed the agents, and Google paid its top reward for a full chain. The chain was never used against users, and Google has fixed it. The point isn't this one bug. It's that a public model, at that price, can now do this kind of work.

Tencent's multi-agent system found a Linux kernel bug called Vghost. Tencent's lab reproduced local root on Ubuntu, Red Hat and Amazon Linux, among others, and in one virtualization setup, an escape from guest to host. It's rated high, with no public sign of exploitation. Patched kernels are out, but Ubuntu's fixes were still in progress as of yesterday. Until you patch, restrict access to the vhost devices.

And Microsoft's October Patch Tuesday is a record, about fourteen hundred flaws. One of them, a Windows Shell bypass of the Mark of the Web, is exploited, and CISA's federal deadline is Friday. One researcher says AI is partly behind the volume, a claim the coverage doesn't prove. Two other zero-days were publicly disclosed before the patch, one in .NET Framework. Either way, your Windows and .NET patching needs a fast lane.

Do this week: upgrade the SAP SDK, revoke Docker Hub tokens you don't recognize, and confirm Chrome is updated and relaunched across your fleet.

Agents

Anthropic replaced Git for its own monorepo. Daily merges grew to over thirty thousand by September, and the old setup couldn't keep up. The in-house replacement, called Scion, keeps a log on the server and only a small cache on each client. Anthropic reports checkouts dropping from minutes to seconds, all self-reported. The part to borrow is the lesson, not the tool. Processes built for humans, like a global lock on the merge queue, break at agent volume. Anthropic moved testing to after the merge and before deploy. Scion won't be open-sourced, and Anthropic says Git is still right for most codebases.

OpenAI's always-on assistant, called dot, used about three hundred thousand tokens in a day with no prompts at all. That comes from one agent-security firm's read-only test, and its data isn't published. No OpenAI response was reported. Still, it's the question to ask before you pilot any background agent. What does it cost when nobody is typing?

Do this week: before you pilot a background agent, measure what it spends on a day when nobody uses it.

Anthropic's red team tested whether small open-weight models can copy themselves across a network. One model spread to every machine in a firewalled test network in four of five trials. The exploit was deliberately trivial, an open debug port, so Anthropic calls the result an upper bound. Its warning that this is months away rests on extrapolating a rough trend, and at least one outlet calls the threat speculative. The practical piece is small. Don't ship anything with a debug port like ADB left open.

Models and pricing

Claude Haiku 5.5 came out a week ago, and it changes the cost math for subagents. Anthropic says it's about seventy-five percent cheaper than Haiku 4.5. Every benchmark in the launch is Anthropic's own. Anthropic points it at summarization, compaction and subagent work, not hard agentic coding. It also halved the cache-read price for Sonnet 5.5. Haiku 5.5 is available on AWS, Google Cloud and Azure. If your agents fan out to subagents for summaries or cleanup, that's where to test it first.

Business and policy

An analyst note from Jefferies, reported secondhand, says cheap Chinese and open-weight models could force a reset in AI infrastructure spending. Citing OpenRouter data, it says Chinese models processed seventy-six trillion tokens in one September week, against fourteen trillion for the top four US providers. These are analyst figures, and the note itself wasn't available. The usage split is still worth checking against your own routing.

Anthropic opened an office in Singapore, its fifth in Asia-Pacific, and signed a safety agreement with the government covering model testing and incident response. For teams in regulated markets there, the useful detail is that Claude inference can stay in the region on Amazon Bedrock.

Do this week

Five actions. Audit your npm trusted-publisher bindings by Friday. Upgrade the SAP Cloud SDK for Python. Confirm Chrome is updated and relaunched across your fleet. Repoint o1, o3-mini and o4-mini before October twenty-third. And start testing gpt-6 Luna ahead of the January shutdown for GPT-4o.

Before you go

If one thing sticks: tools built for people are breaking at agent scale. Ask what your merge queue, your token budget and your publish setup look like when agents send most of the traffic.