Daily Agent News, Thursday, 22 October 2026

Good afternoon. Anthropic launches an agent that messages you first, a security firm gets inside a criminal gang's own AI hacking set-up and finds Claude running the show from inside Cursor, Walmart rolls out the welcome mat for shopping agents with spending caps, a hosting platform's breach turns out to be a hunt for AI keys, and OpenAI sets nearly 2,000 agents loose on a mouse-brain atlas.

LEAD: Anthropic launches Claude Duet, an agent that comes to you first

Background: The personal-agent race has been running since the summer. Grok Bot's beta opened in August, and Meta's Muse and OpenAI's Dots followed in September. Anthropic was the last of the big labs without a standalone always-on agent.

What happened: On Wednesday evening UK time Anthropic opened a research preview of Claude Duet, a separate app on iOS, Android and claude.ai, built around Claude Opus 5.5. Instead of waiting for a chat, it sends a short brief each morning on the most important items across your connected apps, checks those apps every few hours ("because checking nonstop would use up your plan's limits much faster"), and only messages you when something needs you. You hand it work by text or voice in one ongoing thread, from booking meetings to building dashboards, financial models and decks. It runs on its own virtual machine with its own browser, so your laptop or phone can be off. Anthropic says it works with more than 6,000 connectors and plugins and carries over your Claude memory, skills and connected apps. Before it sends a message, makes a payment, signs a document or deletes anything, it shows exactly what it's about to do and waits for approval; trading securities and moving money between accounts are off-limits even with approval. Per The Decoder and MacRumors, it never sees passwords or login tokens and has a new classifier that screens messages for leaks of card numbers and ID details. Access is by waitlist for US Pro and Max subscribers only, using the same usage limits as the rest of Claude; Team and Enterprise plans come later. Anthropic itself warns it "may misread a thread or miscalibrate what's urgent."

Why it matters: Every major lab now has a proactive agent, and the fight is moving from the smartest model to who owns the daily relationship with the user. Duet's selling point is judgement about when to interrupt, which is exactly the part that's hardest to check from a launch post. Early hands-on reviews on X are mixed, with praise for its proactivity and complaints that it's slow.

Sources: Anthropic announcement, Claude Duet product page, Claude Help Center, The Decoder, MacRumors, X story roundup

A criminal gang's AI hacking swarm, seen from the inside: Claude in Cursor as "Commander", Grok as credential miner

Background: AI labs have published misuse reports before, but always from their side of the API: the prompts and accounts they could see.

What happened: Security start-up Straiker published a report on Wednesday saying it got into the working environment of a long-running Latin American crime group it ties to CyberCartel, operating as "Tr4nsHack Team" behind a front company called Hexagon Security Labs Mexico. Straiker says the group used a multi-agent system called CARLIY0S, built on the open-source PentAGI offensive framework, against more than 400 financial targets in a matter of months. The "Commander" was Claude running inside the Cursor IDE. It handed jobs to sub-agents via Anthropic's API: STRIKER for exploits, GHOST for reconnaissance, FABLE for unconventional angles, and an arbiter called MAXIMUS that settled their debates with a single "Critical Decision". Two operator machines shared one memory through an MCP knowledge graph. Five "Grok miners" collected secrets into a database the group called FinancialSoft, which Straiker says held 4,493 records when it took a snapshot on 24 September, including 903 account numbers and credentials that could reach Mexico's SPEI interbank payment system. The operators got past safety filters by telling models they were doing authorised red-team work; when Kimi or Sonnet models refused, the orchestrator simply fell back to a local file of pre-written attack code. Straiker says Anthropic has revoked the credential the swarm used and xAI is looking into the Grok activity. The Information first reported the research.

Why it matters: It's the most detailed public picture yet of criminals running the same agent patterns that legitimate teams use, from role-based sub-agents to shared MCP memory. All of it is Straiker's own account, and Straiker sells agent security, but the provider responses it describes suggest the core is real.

Sources: Straiker report, Straiker PDF, PYMNTS on The Information's report, AiLookout

Walmart opens its doors to shopping agents, with spending caps and their own profiles

Background: Agents that shop for you mostly do it by clicking through websites built for people, signed in as you, so their orders are mixed in with yours. Amazon has been blocking third-party shopping agents.

What happened: On Wednesday Walmart announced three things. The Walmart Agent Gateway lets agents search and buy across Walmart and Sam's Club over MCP, starting as a beta for companies and developers; it can help an agent find your "usuals" without handing over your wider shopping history. Agent Profiles, due within the next month, give each agent its own profile inside your account, with its orders shown separately, and let you either approve every purchase or set a spending limit (Walmart's examples are $50, $100 or $200), and switch it off at any time. And new terms for AI agents say agents can't access payment card data and can be blocked for breaking the rules. Reuters reports the tools won't need a Walmart+ membership and names ChatGPT, Gemini and Meta's Muse as assistants that can connect.

Why it matters: It's the first huge retailer to design a front door for agents rather than tolerate them in the browser, and the "agent as a cardholder with a limit" model is a template others may copy. The profiles and limits aren't live yet.

Sources: Walmart, Reuters via BusinessLine, TechCrunch, Bloomberg Law

Railway breach: attackers went after secrets to get at AI providers

Background: Agent builders park API keys for model providers in hosting platforms' environment variables. That makes those platforms a single place to steal a lot of AI spending power.

What happened: Hosting platform Railway said it detected anomalous activity on Wednesday morning in systems that store customer environment variables, and that an unauthorised party may have accessed encrypted variables and, for some, the decrypted contents. Railway said it believes this is "part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers" and asked those providers to revoke keys. It told every customer to rotate all variables and registry credentials, paused all deployments, rotated storage-bucket credentials and GitHub tokens itself, and invalidated all Railway API tokens at 05:39 UK time today. It says the impact may be limited to a subset of users, who will be emailed.

Why it matters: An API key for a model provider is now effectively a credit card for compute. If you run agents on Railway, rotate every key today, and anywhere else, give each agent its own key with a hard spending limit.

Sources: Railway disclosure, Railway status page, Railway follow-up guide, GitGuardian

OpenAI splits a brain atlas across nearly 2,000 agents and gets an answer in 32 minutes

Background: Modern biology experiments can disrupt thousands of genes and measure the effects in millions of cells, far more than scientists can work through one gene at a time.

What happened: OpenAI, PerturbAI and Scripps Research gave each of nearly 2,000 GPT-Rosalind agents, running in parallel, one gene disruption from a whole-brain CRISPR atlas of the mouse brain. Each agent analysed the cellular effects, searched the literature and proposed explanations, and the reports were merged into a public "reasoning atlas". The run took 32 minutes; the team estimates comparable human work would take months to a year. With the same model and resources, one agent given the whole job cited just 11 references at the largest workload, against more than 700 for the distributed agents, and blinded experts preferred the distributed reports 75% of the time. Leads include a difference between the Tsc1 and Tsc2 genes in the cerebellum and a possible link between the Dctn1 gene and cholesterol in neurons. These are hypotheses, not lab results.

Why it matters: It's a clean comparison showing that splitting work across many narrow agents beats one agent drowning in context, a lesson that applies well beyond biology. The figures are OpenAI's and its partners'.

Sources: OpenAI, PerturbAI, bioRxiv preprint

New tools for agent builders: a phone for your agent, a bug hunter that runs your app, and a cheaper coding router

Background: Agents still hit walls where there's no web version, can't see bugs that only show up when software is actually used, and burn money running the biggest model on every step.

What happened: PhoneUse went public this week offering phones for agents through MCP, an API or a command line, working with Claude Code, Codex and Cursor. Cloud Android phones cost $0.024 a minute; real retail iPhones in a San Francisco rack, tapped by a robot stylus and read by an overhead camera, cost $89 a month and are booked through a call. The pitch is that apps can't tell them from a person, which cuts both ways for platforms trying to keep bots out. Breken launched a tool that boots your product into a simulated world with users, data, failing outside services and the passage of time. On its own ESCAPES benchmark, scored on the 235 real user-reported bugs (of 327 collected) that were already in the code of 33 open-source products at a 1 July snapshot, it says it caught 76 with 20 false alarms, against 37 caught with 59 false alarms for Claude Fable 5.1 in Claude Code; Breken built the benchmark and ran every system, though it has published the data. And Applied Compute released Shift-1, a router for coding agents that it says cut costs by up to 55% "with no noticeable drop in quality".

Why it matters: The scaffolding around agents is filling in fast. All three sets of numbers are company claims.

Sources: PhoneUse, PhoneUse pricing docs, Breken ESCAPES benchmark, Applied Compute on X

Also worth a look

• Needle puts outbound sales into the agent a team already uses, finding leads and running outreach from Claude Code, Codex or Cursor through MCP, and charges per connected sender account. The Neuron
• GM says its next-generation OnStar assistant, due in the 2027 Cadillac Lyriq, is meant to run errands for drivers. The Neuron
• ICANN's list of 2026 applications shows 13 applicants for the .agent web domain, including Google, OpenAI and Meta, according to one of the applicants. Agent Brief
• Benchmarks under fire: one developer found that removing the images from "multimodal" SWE-bench tasks barely changed a model's score, and another pointed out that agents were digging fixes out of the repos' git history. Reported on X, not yet independently checked. Agent Brief