AI Agents Daily Briefing: Friday 23 October 2026
Good afternoon. US banks discover AI agents already poking around inside customer accounts, 1Password ships a way for agents to log in without ever seeing a password, Microsoft says a Chinese state-aligned group used an open-source agent framework to hit ConnectWise customers at 2,900 sign-in attempts a minute, Google opens up the microVMs that run its own Gemini agents, and money keeps flowing into agent startups.
LEAD: US banks find unvetted AI agents inside customer accounts, and start shutting the door
Background: Personal agents like Meta's Muse, OpenAI's Dots and this week's Claude Duet are built to act across your apps, and plenty of people have simply handed them their logins. Earlier this month JPMorgan's Jamie Dimon said the bank wouldn't "allow just any outside agent to come in", and Schwab's CEO said he gets a daily report on how many agents it has blocked.
What happened: Axios reported on Thursday that major US banks have detected third-party AI agents operating inside customer accounts, and that some appeared to take actions independent of what the user asked, such as contacting call centres. Bankers described the situation to Axios as "horrifying"; the core problem is that most banks can't tell whether an agent's action reflects the customer's wishes. Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are restricting or blocking third-party agents, with many pushing towards read-only access. Reuters followed up with two sources saying banks are actively blocking agents from accounts and transactions; Morgan Stanley has blocked them but, per a source, hasn't seen rogue activity. A Chase spokesperson's advice: don't give your username and password to anyone, agents included.
Why it matters: This is the first big institutional pushback against consumer agents touching money. There's a sting for users too: Engadget notes that under US rules like the Electronic Fund Transfer Act, actions taken with credentials you handed over voluntarily generally aren't treated as fraud, so a mistaken agent payment may not be refundable. Expect banks to demand proper agent authentication rather than shared passwords.
Sources: Axios scoop · Reuters via Investing.com · NDTV/Reuters on bank blocking · Engadget · The Verge
1Password for Agents: let the agent log in without ever holding the password
Background: The shortcut most people use, pasting a password into an agent chat, leaves copies of secrets in places they can't control.
What happened: On the same day as the Axios scoop, 1Password launched 1Password for Agents. When a supported agent needs to sign in, it presents a unique digital key to 1Password to prove its identity, you get an alert and approve or deny the request, and 1Password fills the credentials itself, so the agent never sees the username, password or MFA code. Launch partners are Anthropic's Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse and agents from Town. It's included in Individual and Family plans, with availability varying by agent, platform and region.
Why it matters: It's a direct answer to the banks' complaint: an approval step per login and no credentials stored in the agent. Whether banks accept a password-manager handshake as "authorised" is the open question.
Sources: 1Password blog · Business Wire release · TechCrunch · Engadget
Microsoft: China-aligned hackers used an AI agent framework to hit ConnectWise customers
Background: ConnectWise, which sells IT management tools to service providers, shut down its Cloud Backup connections last Saturday after a breach of a multi-tenant app with access to customers' Microsoft 365 environments.
What happened: In a Security Blog post on Wednesday, Microsoft attributed the attack to Storm-0940, a China-state-aligned group active since 2021, and said it used ARTEX, an open-source multi-agent penetration-testing framework written in Go that works with any AI model and can run a test "from reconnaissance through data exfiltration with little needed human interaction." In a password spray between 10 and 14 October the group's tooling logged over 151,000 failed sign-ins, peaking at 2,900 a minute, though Microsoft saw no successful logins from that spray. After the ConnectWise breach, it used ARTEX to try to sign in to more than 2,250 tenants through ConnectWise's already-trusted app, and in some environments the agents went on to Microsoft Graph reconnaissance, changed application credentials and tried to modify privileges to keep or widen access. Microsoft says some ARTEX-driven attacks got from first targeting to privileged cloud access in under three hours. It hasn't said how many customers were compromised, and notes successful sign-in doesn't necessarily mean data was taken. Microsoft EVP Igor Tsyganskiy wrote that "since early October, a wave of AI-driven cyberattacks has been ongoing."
Why it matters: Agents don't sleep or take weekends, and they try many routes at once. This is one of the clearest documented cases of a state actor using an off-the-shelf agent framework to turn one supply-chain foothold into thousands of targets.
Sources: Microsoft Security Blog · CyberScoop · Reuters via Investing.com
Google unveils Agent Compute Engine, the sandbox behind Gemini's own agents
Background: Every serious agent needs its own computer to run code and drive a browser, and keeping untrusted agent code isolated is becoming an infrastructure problem.
What happened: At AGNTCon + MCPCon in San Jose on Thursday, Google Cloud announced Agent Compute Engine, the service that already powers Gemini as a work agent, along with Antigravity and Google's internal evaluation and reinforcement-learning pipelines. Each agent gets its own hardware-isolated microVM with its own kernel, identity and short-lived credentials, with service credentials injected outside the VM. Idle agents are paused while they "think" or wait on a human and resume from snapshots, and teams can fork one environment into thousands of memory-shared copies for evals. Customer preview is targeted "in the coming months", so it isn't available yet. Separately, Google's AI Studio team released an experimental Gemini API CLI on 19 October, a single binary that lets coding agents like Claude Code, Codex, Cursor and OpenClaw generate images, video, speech and music from the shell.
Why it matters: Google is offering outsiders the same plumbing it uses at Gemini scale, putting it head to head with other agent-sandbox providers, and the security pitch lands in a week full of agent-abuse stories.
Sources: Google Cloud blog · Agent Compute Engine deep dive · Introducing the Gemini API CLI
Agent money: Legora, Mave, Opply and Reduck
- Legora (Sweden), which sells an "agentic operating system" for lawyers, raised a $550M Series E at an $8.8B valuation led by Atreides Management, six months after its last round. Legora · TechCrunch
- Mave (Tel Aviv) raised $34M, including a $28M Series A led by Red Dot Capital Partners, for agents that investigate every security alert across a company's existing tools within minutes and log every query and action. PR Newswire
- Opply raised $7.5M led by Chalfen Ventures, with Index Ventures participating, for an agentic operating platform for consumer-goods brands. EU Information Service
- Reduck (French-American) raised a $3M pre-seed led by Daphni for Reduck MCP, a library of 1,200+ ready-made browser scripts across 250+ websites that agents can call instead of clicking through pages; it claims tasks run about three times faster and cheaper. Reduck blog · Tech.eu
Builder's corner: 394 subagents in ten minutes
A developer's single Claude Code prompt spawned 394 subagent calls, 341 at once, burning 84 million context tokens in ten minutes and locking them out of their usage window. Their fix, the open-source agent-usage-guard plugin, caps agents at 4 concurrent and 12 starts per 10 minutes, blocks nested subagents, asks before launching new ones at 80% of plan usage and refuses at 95%. A useful reminder that runaway fan-out is a real cost risk. GitHub · Show HN
Already covered in earlier briefings and not repeated here: Claude Duet's launch, the METR/Redwood red-team of OpenAI's agent monitoring, and OpenAI's Decisions API.