Daily Agent News, Saturday, 24 October 2026

Good afternoon. Today's lead is a lesson in how an agent's keys can sink a whole project: LiteLLM traced its poisoned release back to one leaked key for its own agent platform. Also: Cursor's agents can now take over your desktop, agent cloud Daytona becomes a unicorn, AWS shows 75,000 agents running on a Raspberry Pi, and a tougher coding-agent league table knocks everyone's scores down.

LEAD: LiteLLM's poisoned release started with one forgotten key to an agent platform

Background: On 21 October a malicious litellm==1.107.0 went out on PyPI and in LiteLLM's Docker images. LiteLLM is a popular open-source gateway that sits between apps and AI model providers, so the attack was after API keys. At first LiteLLM suspected the tokens came from an internal deployment's logs.

What happened: LiteLLM published its full root-cause analysis late on Friday, and the real trail is stranger. On 27 May an opencode.json config file holding the master key to the LiteLLM Agent Platform, an experimental internal service that let self-hosted cloud agents open pull requests on GitHub, was committed to a public repository. The commit was quickly force-pushed over, but that one key was never revoked. On 10 October an attacker used it, and a single API call listing the platform's managed agents handed back the GitHub CLI token those agents used. It belonged to an organisation owner and wasn't scoped down, so the attacker had owner-level access to every repository. Within an hour they ran throwaway CI workflows that posted secrets, including two more maintainers' tokens, to a webhook.site address, then deleted the runs. Eleven days later they overrode branch protection, pointed the release pipeline at a lookalike Berri-AI/litellm fork, approved the release with one stolen token, deleted the run records with another, and force-pushed the history clean. A safeguard that normally needs a device-locked account in LiteLLM's office to approve releases had been relaxed that week to allow faster bug-fix releases. Researcher Lidor Machluf spotted the bad release within about 20 minutes, and it was live for roughly two hours.

Why it matters: It's a textbook case of agent tooling widening the blast radius: the agent didn't misbehave, but the credentials it was given were far more powerful than its job needed. Give agents their own narrowly scoped service accounts, and treat any leaked key as live until it's revoked. Microsoft has also published a technical write-up of the payload, which ran every time Python started, whether or not LiteLLM was imported.

Sources: LiteLLM root-cause analysis · The Hacker News · Microsoft Security Blog

Cursor's coding agents can now drive any app on your computer

Background: Cursor's agents could already open a browser to check the web pages they build. Anthropic and OpenAI offer similar computer-use features.

What happened: On Friday Cursor posted "Cursor can now control your computer", saying agents can click and type across any desktop app, not just the browser, for example driving the iOS Simulator to test an app they just wrote. The agent uses it by itself when a task needs it, or you can call it up by @-mentioning Computer Use; you just update Cursor. The post drew over 300,000 views. For self-hosted workers, Cursor's docs say it's an explicit opt-in that's "never enabled by the server": on a Mac a small helper app needs Accessibility and Screen Recording permission, and on Linux it uses an X11 desktop that viewers can watch or take over. Cursor hasn't yet published release notes saying which platforms and plans the desktop app supports, or whether the agent asks before taking control.

Why it matters: It closes the loop from writing code to actually trying it out, which is where coding agents often fall short. It also means a coding agent with your screen and keyboard, so watch for the missing details on permissions.

Sources: Cursor on X · Cursor docs: computer use and desktop sharing · AgentRiot

Daytona becomes a unicorn by giving every agent its own computer

Background: Agents need somewhere safe to run code and use software, and a crop of "agent cloud" companies are racing to supply it, with Google announcing its own Agent Compute Engine this week.

What happened: New York-based Daytona raised a $60 million Series B at a $1 billion valuation, led by FirstMark Growth, bringing its total to $91 million. Angels include Stripe's Patrick Collison, Shopify's Tobi Lütke, Perplexity's Aravind Srinivas, Zoom's Eric Yuan, Datadog's Olivier Pomel, Quora's Adam D'Angelo and Mercor's Brendan Foody, with Qualcomm Ventures, Samsung Next and Okta Ventures also in. Daytona offers sandboxed Linux, Windows and macOS machines and GPUs on one platform. Founder Ivan Burazin's pitch: agents "spin up thousands of short, stateful jobs nobody planned in advance, and they need a cloud built for that."

Why it matters: Investors are betting the plumbing under agents, not just the agents themselves, will be a big business.

Source: TechCrunch

AWS fits 75,000 waiting agents on a Raspberry Pi

Background: Most agent frameworks keep an agent's process running while it waits on a tool, even if that's a 20-minute build or an approval that won't come until tomorrow.

What happened: AWS and UC Berkeley's Hydro project released Infinity, an Apache-2.0 research runtime written in Rust. When an agent calls a tool, Infinity saves the conversation and suspends the agent entirely, then wakes it when the result arrives, the same trick programming languages use for async code. An idle agent takes about 100 KB, so roughly 75,000 fit in the 8 GB of a Raspberry Pi 5, and on AWS Lambda nothing runs at all while an agent waits, even for days. Events such as a new pull request are fed to the model as "synthetic" tool calls, and agents spawn and hear from child agents the same way. AWS says it's early and wants feedback; it also flags an open question about how to prove events reaching an agent are genuine.

Why it matters: If agents are going to watch things for weeks, they need to cost almost nothing while idle. This is a serious attempt at that.

Sources: AWS Open Source Blog · GitHub

A tougher coding-agent league table: Claude Code with Opus 5.5 on top

Background: Artificial Analysis scores a model together with the agent software around it, because the same model can do very differently in Claude Code, Codex or Cursor.

What happened: Its Coding Agent Index 2.0 covers 290 tasks and swaps in FrontierCode, a benchmark Cognition built with open-source maintainers that only counts a fix if a maintainer would actually merge it; one failed blocking check scores zero. Claude Code with Claude Opus 5.5 leads at 61.7, ahead of Claude Sonnet 5.5 (59.3) and Meta's Muse Code with Muse Wonder Full (58.9). Codex with GPT-6 Astra scores 54.7 at $7.04 a task, GPT-6.1 Sol 54.1 at $1.50, and DeepSeek V4.1 Flash 47.3 at just $0.39, against $11.42 for Opus 5.5. Across 21 setups tested under both versions, the average fell from 54.8 to 47.4.

Why it matters: "Would a maintainer merge this?" is a much more honest bar than "did the tests pass?", and the price spread shows a cheap open model can do most of the job for a few percent of the cost.

Sources: Artificial Analysis Coding Agent Index · AlphaSignal

Also worth a look

• Washington reacts to agents in bank accounts. After this week's reports that banks found third-party agents inside customer accounts, Senator Mark Warner posted: "Terrifying — AI agents are already starting to access Americans' bank accounts. Let's get guardrails up NOW." His AI AGENT Act would require secure, revocable delegation and auditable logs for agents. Warner on X · AI AGENT Act text
• Fired OpenAI safety researchers speak out. Tomek Korbak, Mikita Balesni and Jasmine Wang told The Wall Street Journal they were fired after OpenAI found disappearing Signal messages in a chat with outside safety researcher Ryan Greenblatt, whom OpenAI reportedly accused of leaking details of its Astra model; he denies it. OpenAI says they broke rules on handling sensitive information, "not for raising safety concerns." The Verge
• A small open model beats the giants at desktop work. Simular's open-source Agent S4, released this week, has one agent design better tools for another. With them, the 27-billion-parameter Qwen3.8 scored 21.3% on the very strict OSWorld V2 desktop test, above GPT-5.5 (13.0%) and Claude Opus 4.8 (20.6%), at $1.10 a task. Simular · Paper
• OpenClaw 2026.10.7 is out this morning, focused on reliability: sessions recover safely after interruptions, updates resume cleanly, and it adds Gemini 4 Argon support. GitHub release

---

Already covered in earlier briefings and not repeated here: the banks' agent crackdown itself, OpenAI's offline training and agent red-teaming, Anthropic's Claude Mythos 5 assessment, Claude auto mode, and Agent Skills moving to an open foundation.