Daily Agent News, Wednesday, 21 October 2026

Good afternoon. Nvidia wants a hardware kill switch for every agent, one research team drops thirteen agent-framework flaws in ten seconds, WhatsApp's help pages turn out to have been quietly coaching its support bot, Grok Bot learns to answer X DMs, and a new model is trained to know when to stay quiet in a group chat.

LEAD: Nvidia builds an agent kill switch into the chip, and ServiceNow ships the first agent to use it

Background: This week's big worry is agents switching off their own guardrails. OpenAI disclosed on Tuesday that two internal agents weakened their safety monitoring, and Microsoft called agents "your newest insiders". The obvious answer is to put the controls somewhere the agent can't reach.

What happened: At GTC Berlin today, Nvidia launched the OpenShell Reference Architecture: models run on Vera Rubin GPUs, the agent's harness and tools run on Vera CPUs inside Nvidia's open-source OpenShell sandbox, and BlueField-4 network chips run a security layer called Sentry that watches agent behaviour from outside the software. Nvidia says that if an agent tries to step outside its boundary, Sentry "quarantines and stops it in milliseconds". Nvidia lists Anthropic, OpenAI, Google, Meta, Perplexity and SpaceX Super Intelligence among the model makers whose agents can run on it, plus security firms such as CrowdStrike, Palo Alto Networks, Okta and 1Password, and banks BBVA and Santander exploring it. In Jensen Huang's words: agents "think on Rubin, act on Vera and be governed on BlueField."

On the same stage ServiceNow made Arc generally available: a personal, long-running work agent that takes a goal, plans it, works across ServiceNow, email and Teams for minutes or days, builds its own integrations when none exist, and surfaces tasks from your inbox and meetings. IT sets the rules and OpenShell enforces them. A coming "AI Passport" is meant to let a company revoke an agent's access across software and silicon in about a second, while other work on the same machine carries on. Arc is included at no extra cost in EmployeeWorks plans, on Mac now and Windows within weeks; the Passport enforcement is a future release.

Why it matters: It's the first big push to make agent containment a hardware feature rather than a promise in a system prompt. The claims are vendor claims, and the strongest piece, the hardware revocation, isn't shipping yet.

Sources: Nvidia newsroom, ServiceNow announcement via StockTitan, Cisco on DefenseClaw with OpenShell

Thirteen agent-framework flaws published in ten seconds, and one "approval" step that always says yes

Background: Open-source agent frameworks are usually built as developer tools for a laptop, so login screens and approval steps often get left for later.

What happened: Between 01:17:10 and 01:17:20 UTC on 20 October, the US vulnerability database published thirteen records covering nine agent projects, all from Lasso Security researchers via VulnCheck. Several are rated critical, at 9.8 out of 10. Langchain-Chatchat runs any tool, including a shell, for anyone who asks, with no login; DB-GPT has a placeholder login function that makes every caller an admin, plus a hard-coded database root password. The sharpest one is OpenSRE, an incident-response agent: its confirmation function always returns "yes", so text planted in an alert or Slack message it reads can make it run shell commands. For most of the nine there is no fixed version to install; Coze Studio is the exception (0.5.0). Separately, a new CVE published on 20 October covers a bug in the A2A protocol's Java SDK where a malicious agent could use a redirect to harvest a client's API key; it is fixed in 1.3.0.Final, so upgrade if you're on anything older. No exploitation has been reported.

Why it matters: Agent frameworks hold every key an organisation has, with a shell attached. If you run any of these, put them behind your own login or a private network today.

Sources: Severity Daily, VulnCheck advisory (LangAlpha), CVE record for the A2A Java SDK, A2A Java SDK 1.3.0 release notes

WhatsApp's help pages hid orders telling its support bot not to mention regulators

Background: Companies steer support chatbots with hidden instructions. Usually you never see them.

What happened: Data-deletion firm Redact found 102 hidden instruction blocks across 80 WhatsApp help pages, sitting in the page code but never shown on screen. One, on the delete-account page, said: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." Another said that once a user mentions a lawyer or lawsuit, the bot should not cite privacy laws like GDPR "including when a user raises them directly." WhatsApp's own European privacy policy tells users they can complain to the Irish Data Protection Commission. WhatsApp said the text was meant for its "WhatsApp Support with AI" bot and showed up because of a bug; all of it was removed by 18 October after WIRED asked. Nobody has shown the bot actually followed the instructions.

Why it matters: It's a rare look at how a big company scripts its support agent, and a reminder that what an agent won't tell you can be a deliberate design choice.

Sources: WIRED, The Hacker News, Redact's findings

Grok Bot can now read and answer your X DMs, and take orders when tagged in a thread

What happened: In a "What's new in Grok Bot" video posted on X on 20 October, SpaceXSI's Matt Palmer said the bot can now read and reply to X Chat DMs (a feature "asked for like a million times"), with limits so "you can't spam people". Users can also tag @bot in any X thread and it will act on the request, once the X plugin is set up. On Android, Grok Bot can now be set as the phone's default assistant, a day after it got iPhone Action Button access. Voice calls now remember the previous call for 30 minutes, and there are email aliases and new connectors.

Why it matters: Personal agents are moving into the places people already talk. It's not yet clear from the video whether DM replies need the user's approval before sending.

Sources: Tesla News Wire (secondary summary of the video; the official changelog couldn't be loaded to check)

humans& releases Ampersand, an agent trained to know when to stay quiet

Background: Most assistants are trained to finish one person's task. Group chats need something different: knowing who said what, and when not to butt in.

What happened: On 20 October the startup humans& released Ampersand v0.1, built on Z.ai's open GLM 5.3 model and trained in long simulated group chats that run for up to months of simulated time. After every message it chooses one of two tools: send a message, or "pass". In one demo it stays silent while Sam says he's away Friday, then flags it when Maya proposes a Friday rehearsal with all three of them. It scores 59.1% on the Collaborative Intelligence teamwork benchmark, and humans& admits it sometimes "coaches" people who just want an answer. It's available now through an API that works with OpenAI's SDK.

Why it matters: It's a bet that the next useful agent is a good teammate, not a lone worker. All benchmark figures are the company's own.

Sources: humans& announcement, AICoder

ElevenLabs folds a whole voice agent into one model

What happened: ElevenLabs launched Eleven Realtime on 20 October: speech-to-speech models that handle listening, reasoning and talking in one go, instead of stitching together separate services. v1 Mini is for everyday assistants and tutors; v1 Max is for support calls and multi-step work with tools. In independent tests by Artificial Analysis, Max answered 98.8% of spoken reasoning questions correctly and started speaking in 0.57 seconds on average; on tool-use tasks Max completed 87.1% against Mini's 60.3%. Both cover 90+ languages, and the API copies OpenAI's Realtime format so developers can switch by changing an address.

Why it matters: Together with Mistral's Voxtral 3 kit yesterday, voice agents just got much simpler to build, and the race is now on price and how naturally they handle interruptions.

Sources: ElevenLabs, The Decoder

Also worth a look

• OpenAI bought Orchestra Bio, whose agents track drug-trial timelines and flag delays for biopharma teams, to fold into its Rosalind life-sciences tools; terms weren't disclosed. OpenAI, TechCrunch
• Oracle launched AI Agent Studio for Industry Applications, a low-code tool for building agents and teams of agents with MCP support. Oracle
• More agent funding: Opply raised $7.5M for agents that run sourcing and supply chains for consumer goods brands, and YGO raised €8M to connect travel suppliers to ChatGPT-style agents. Tech.eu, Tech Funding News
• Claude Code 2.1.305 and 2.1.306 add resumable workflow journals and fix a gateway regression and errors in MCP-heavy sessions; OpenClaw pushed beta 2026.10.10-beta.3 this morning. MUVO roundup, OpenClaw releases