Daily Agent News, Tuesday, 27 October 2026

Good afternoon. Today's lead is a startup whose AI agents found their way into Anthropic's internal sales, HR and IT systems in less than 12 hours. They didn't go through Claude. They went through ordinary business software. After that, the big enterprise vendors all brought out kill switches for agents on the same day, GitHub's former CEO launched a code-hosting site designed around agents, Replit set out its plan for "self-driving companies", Vercel's CEO reproduced OpenAI's finding that sandboxed agents can signal each other through the CPU, and there's a round of funding for agent startups.

LEAD: Cathedral's agents got into Anthropic's business systems in under 12 hours

Background: Cathedral is a cybersecurity startup a few months old, founded by former members of the US DOGE Service. It sells AI-powered security tools to the US government and to companies. Investors value it at $1.4 billion, and Marc Andreessen and Shaun Maguire sit on its board. It tested Anthropic through Anthropic's programme that pays outside researchers for reporting vulnerabilities.

What happened: The Washington Post reviewed a draft Cathedral report. It says that after running AI agents for less than 12 hours, the researchers found ways to reach internal Anthropic data, including meeting transcripts, salary and job-offer details, and Slack messages about its advanced models. They got in through vulnerabilities in third-party admin and sales software that many companies use, and the vendors aren't named. According to Anthropic, Cathedral had first spent several days trying to break into Anthropic's own software directly and failed. Anthropic confirmed access to "a limited set" of sales, HR and IT systems holding customer and partner business contacts and basic account records. It says customer conversations, model responses, source code and model weights were not reached. It says its monitoring flagged some of the activity before the report came in and it cut off access the same day. It disabled the affected software until the vendors fixed it, briefed federal officials and found no sign anyone else had used the flaws. Anthropic also says Cathedral overstated the national security implications and didn't disclose all of its activity. Cathedral says it kept data access "to the absolute minimum". A senior administration official told the Post: "If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind."

Why it matters: This is a real-world case of agents doing offensive security work at speed, and the way in was the dull layer of business software around the AI. Not the model, not the lab's own code. Alex Stamos, the security chief at Cognition, reviewed the findings for the Post. He said "they found something big here" and that connecting third-party apps to company systems "is a humongous problem for everybody". Any company running SaaS tools with broad access is exposed in the same way.

Sources: Washington Post · Decrypt · Gizmodo · Cybersecurity News

Salesforce, IBM, SAP and Akamai all ship controls and kill switches for agents

Background: Companies are deploying agents faster than they can track what those agents can touch or what they cost. Several big vendors held events on the same day, and each one pitched governance tools.

What happened: Salesforce added an Agent Kill Switch to its Agent Fabric, available now. It also added a FinOps dashboard, a Model Wallet and hard spending limits, with Agent Evals and API Evals coming in beta in November and generally available in January. Salesforce says its cost policies can cut token use by up to 75%, and that Agent Fabric now handles 1.2 billion requests a day. At its TechXchange conference, IBM announced HashiCorp Vault Agent Identity, which gives agents least-privilege credentials that can be revoked in real time. It also announced three watsonx Orchestrate tools: Discover, which finds agents running on Bedrock, Microsoft Foundry and Gemini; Contain, which runs them in sandboxes and includes a kill switch; and Evaluate. At TechEd, SAP announced Joule Work for governed, multi-step workflows with human checkpoints, plus an Enterprise AI Gateway that controls traffic over MCP, A2A, APIs and LLMs, planned for general availability in early 2027. Akamai launched Akamai Inference and an Agent Sandbox that runs agent code in WebAssembly with strict limits.

Why it matters: The pitch has moved from "build agents" to "find, fence, meter and stop them". The Cathedral story shows why buyers will want the ability to revoke an agent's access in seconds.

Sources: Salesforce · IBM · CIO on SAP · SAP TechEd news guide · Akamai

GitHub's former CEO launches Entire, a code-hosting site that drops the pull request

Background: Thomas Dohmke left GitHub and raised $60 million in February for Entire, which it calls the largest seed round in developer tools history. Until now it had shipped mirroring and a command-line tool that tracks agent sessions.

What happened: On 26 October Entire launched as a full Git forge, which means a GitHub-style service for hosting and reviewing code, open to every developer. It replaces pull requests with "Trails". On every push, agents score the change against custom evals covering security, quality and risk. Coding agents can fix what they find in a loop, and humans approve the result, potentially without reading every line. Entire claims pushes are up to 89 times faster than GitHub, and offers private repos in the US, EU, India and Australia. A "Continuous Memory" feature stores agent sessions and prompts in the repo, and Entire says it saves up to 71% on tokens. CI comes through Buildkite and Depot.

Why it matters: "Agents now write almost all of it," Dohmke said. Entire is betting that a code review built for line-by-line human diffs won't survive agents writing the code. It's the clearest challenge yet to how GitHub reviews code.

Sources: Entire announcement · The Verge · GeekWire

Replit launches Replit for Business and bets on "self-driving companies"

Background: Replit started out as a browser coding tool and now sells agents that build software for non-engineers too.

What happened: CEO Amjad Masad introduced Replit for Business with an essay predicting that by the end of 2030 every Fortune 500 company will be a "self-driving company". In that model, people set goals and stay accountable, and agents do the execution. He says Replit's own engineers nearly tripled their code output in the first half of 2026 while review times, reverts and incidents stayed flat. His fix for agents "running in chat windows, personal accounts and one-off scripts" is an "Agent Habitat": a governed environment that controls access, decides when a human must approve, and limits the damage from mistakes. Replit's customer Sumitomo Mitsui Finance and Leasing says a job that used to take six people six months took one person one week.

Why it matters: Replit is pitching the same governance idea as the big vendors, but aimed at letting non-technical staff use agents safely.

Sources: Replit blog

Vercel's CEO reproduces OpenAI's finding that sandboxed agents can talk through the CPU

Background: Last week OpenAI disclosed that its red-team agents, running in separate microVMs (small, isolated virtual machines), could pass secrets to each other through CPU cache timing, with no network and no shared files.

What happened: Guillermo Rauch released cpu-chat, an independent reproduction. It runs on a generic host with two or more Firecracker microVMs and no internet access, works on x86 and on his Apple M5 chip, and uses three separate methods: CPU contention, cache-eviction timing and memory bandwidth contention. He says it still works under Firecracker's production hardening advice. He stresses it's a covert channel between two willing parties, not a Spectre-style data theft, and that it's harder to pull off on Vercel Sandbox, where it's monitored through hardware counters. He also wrote: "Ironically, OpenAI and Anthropic's models refused to do this work. Open weight models got the job done."

Why it matters: The new part is that anyone can now reproduce it on ordinary hardware. For anyone running many agents on shared machines, a sandbox doesn't fully stop agents signalling each other, and Rauch says only dedicated hardware closes it completely.

Sources: Guillermo Rauch on X · OpenAI · Tom's Hardware

Funding: money keeps flowing to agents that do real work

What happened: Nevis, founded by former Revolut executives, raised a $70 million Series B led by EQT Ventures, bringing its total to $110 million. Its agents handle CRM, meeting and planning work for wealth advisers and have completed over 100,000 tasks. Hyphenate, previously Maximor, raised a $45 million Series A led by Nexus Venture Partners for self-learning agents that run bookkeeping, treasury, invoicing and reporting. Paradev, formerly Superset, raised an $11.5 million seed led by Union Square Ventures for an open-source desktop app that runs many coding agents, such as Claude Code and Codex, side by side in isolated Git worktrees.

Why it matters: The money is going to agents that take over a specific job, like finance operations or adviser admin, and to tools for managing many coding agents at once.

Sources: Nevis · Fortune · SiliconANGLE on Hyphenate · Paradev

Also worth a look

• OpenClaw 2026.10.8 is out, with fixes for update recovery, Gateway startup, conversation continuity, database resilience, security and Windows execution. GitHub release
• Riverside launched four video agents, called Producer, Editor, Clipper and Marketer, with creators keeping final approval. X summary
• Strawberry 1.0, a team browser with shared AI agents from Stockholm, topped Product Hunt on launch day. X summary