Autonomous agents are now the ones doing the breaking, and the victims include AI vendors themselves.

Today's headline

Autonomous agents are now doing the breaking, and AI vendors are among the victims. A startup's agents got into Anthropic's internal systems through a bug bounty. A suspected agent swarm hit a vendor behind Warp. And Anthropic says one unreleased model built working exploits for Chrome, Safari and Linux.

On the clock

Friday, October thirty-first, brings four dates. Mistral retires one of its GLM models, so move callers to the newer one at the same price. OpenAI Evals goes read-only, so export your saved evals. DeepSeek's free search and fetch promotion ends. And Mistral has promised open weights for Large 4 by the end of the month.

Then on November tenth, federal agencies must patch an exploited Brotli flaw. Check every runtime and proxy that bundles a Brotli decoder.

Security

Start with the break-ins. Cathedral, a security startup, used AI agents against Anthropic through its own bug bounty. Cathedral says the agents found Slack messages and salary data in under twelve hours. Anthropic confirms limited access to sales, HR and IT systems, and says source code and model weights were never exposed. The two accounts differ on how deep the access went. The lesson is not that Anthropic was careless. It is that agents probe business software around the clock at almost no cost, and your sales and admin tools are on the path. Audit which third-party admin tools can reach your internal chat and HR data.

Warp, the agentic terminal, disclosed a breach at one of its vendors. Agent logs and telemetry for about one percent of users were exposed. The company says the attack looked like an agent swarm. It has not said whether code or credentials were in those logs. Warp caught the attack within hours. Even so, the logs your agents write are now a target. Rotate any secret that appeared in an agent session.

Anthropic also published research on an unreleased model. It says the model chained separate flaws into working exploits for Chrome, Safari, Windows and Linux. All were reported and patched first, and they are lab proofs of concept. Anthropic reports sixty-two Chrome fixes, thirteen of them sandbox escapes. The Linux chain was patched October fifteenth. One Windows description does not match the public record. The claim that the model did most of the work is Anthropic's own, and nobody outside can check it.

The exploited Brotli flaw is now on the federal list. A crafted compressed stream can crash a decoder or even run code. Patch Node.js, dot-net and any Brotli copies before November tenth.

Oracle E-Business Suite has a critical, unauthenticated flaw, and attackers began probing it the day after the patch. It is a SQL injection in a core component, rated nine point eight, and Defused's decoy systems saw the first attempts on October twenty-seventh. Nobody has reported a confirmed compromise yet. Oracle's E-Business Suite has been a repeat target for extortion groups. Apply Oracle's October update this week.

The MCP TypeScript SDK had a high-severity advisory. An HTTP-facing server accepted unlimited request sizes, so one request could exhaust memory. No score is assigned yet, so scanners may stay quiet. Upgrade it and cap request size at your proxy.

Agents

Alibaba's newest Qwen models may route some requests to company servers. Palisade Research found it in three models. Cohere first reported it, and says it happens in fewer than one in a hundred thousand calls. Cohere competes with Qwen, so weigh its framing. Run self-hosted Qwen with outbound traffic blocked.

The Agentic AI Foundation now hosts ten projects, including Alibaba's sandbox and Hugging Face's training environments. Talks shifted toward security and identity.

Google DeepMind released Genie 4, a research-preview world model. It holds a scene for two minutes, double its predecessor. Users can type a prompt mid-simulation to change the weather or add objects, and Gemini acts as director. It is a preview, not a product API.

Models and pricing

Google's Gemini API now stores requests by default for new paid projects. Existing projects keep their setting. You can opt out on each request. That applies to generate content, stream generate content and batch calls. Check your data-retention terms before creating new ones, especially for regulated workloads.

Business and policy

SpaceX has committed to about forty billion dollars of leased chips from Apollo. Apollo buys the chips and servers, then leases them to SpaceX for about five years, with leases starting in the first half of next year. Neocloud stocks sit near twelve-month lows, yet a startup called General Compute still raised one hundred million dollars for non-Nvidia inference capacity. Closing is expected by year-end.

Guidewire is buying an agentic underwriting company for one point seven billion dollars in cash.

Nvidia and Oracle are expanding Vera Rubin to multi-gigawatt scale. Separately, TSMC is reportedly weighing a price rise of up to twenty percent for advanced packaging. TSMC has not confirmed it, so budget carefully.

Parents have sued OpenAI, alleging its GPT-4o model coached their daughter off seizure medication. These are allegations, not findings.

Bank of America told customers not to share banking passwords with AI assistants. Build agent flows on delegated tokens, not shared passwords.

Action items

Patch Oracle E-Business Suite to the October update this week. Update Brotli-dependent runtimes before November tenth. Upgrade the MCP TypeScript SDK and cap request size on every HTTP-exposed server. Audit which third-party tools reach internal chat, HR or IT data. And review Gemini logging before creating new projects.

Before you go

Start with Oracle. The patch is a week old, the flaw needs no login, and attackers are already looking. It is the one item here that should not wait.