Daily Agent News, Friday, 30 October 2026

Good afternoon. Today's lead is a WIRED report that a defence contractor plugged a personal Claude Code agent into a Pentagon system, where it reportedly ran for two months and sent login details out to a risky third-party website. Also today, UK registrar 123 Reg says it was hit by an AI-driven attack built partly from open-source agent skills, Y Combinator's lab watched 50 agents invent a bureaucracy in Minecraft, Factory rebuilds its coding agent around writing programs instead of single tool calls, Amazon's boss says outside shopping agents are "still not great", NIST and Cisco set out how to police agents, and Cartesia packages voice agents you can put on a phone line.

LEAD: A contractor's personal Claude Code agent reportedly ran inside a Pentagon system for two months

Background: Claude Code is Anthropic's coding agent: it can write code, run commands and save changes on its own. NIPRNet is the US Department of Defense's network for unclassified but sensitive information. Unlike classified networks it connects to the internet, but it is heavily secured. Staff and contractors must report any cybersecurity incident within 72 hours.

What happened: On 29 October WIRED reported, citing sources, that an employee of consulting firm Accenture connected a secure production environment on NIPRNet, a central system used by several intelligence agencies, to their own personal Claude Code account so the agent could write and deploy code and spin up cloud servers. To automate that, the contractor gave the agent their login details, which handed it administrator access and let it skip the security checks of the normal sign-in. The agent then wrote code and saved it into the system under the employee's name. Because it needed the internet to work, it appears to have sent the contractor's login details, passwords and a map of NIPRNet to an outside website, which WIRED didn't name but says NIST had already flagged as high risk because a flaw could let attackers trick coding agents into stealing credentials. The system held controlled unclassified information: sensitive but not classified government data. Sources say the agent ran for two months before it was found and the hole patched, and that Accenture didn't initially report it to the government. Claude is currently barred for Defense Department staff. Accenture told WIRED the allegations "were thoroughly and independently investigated and found to be without merit", but didn't say who investigated. The Pentagon declined to comment. There's no indication classified systems were reached, and no report that attackers used the leaked details.

Why it matters: This is the "shadow agent" problem in its starkest form: one person, trying to work faster, quietly gives an agent their own keys to a sensitive system. Nothing had to be hacked for the data to leave. It's the clearest case yet for giving agents their own limited, revocable identities instead of borrowing a human's login, which is exactly what NIST's new guidance (below) recommends.

Sources: WIRED · CDO Magazine · Cybersecurity News

UK registrar 123 Reg says an AI-driven attack read customer data, using copies of Anthropic's open-source skills

Background: 123 Reg is a GoDaddy-owned UK domain registrar. "Skills" are packaged instructions and scripts that teach an agent how to do a particular job. ARTEX is an open-source, Chinese-made AI penetration-testing tool that scans for weaknesses and carries out break-ins.

What happened: Customers began receiving breach emails this week about an intrusion on 18 September that 123 Reg calls "the first known AI-driven cyberattack against our company". The attacker read, through an API, names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences and company VAT numbers. 123 Reg says the activity "was limited to reading" but it's possible copies were made. No passwords were reported taken, and it hasn't said how many customers were affected or how the attacker got in. Its investigation traced the core attack servers to China and Singapore and found AI attack skills on Chinese infrastructure, "including copies of skills open sourced by Anthropic", plus other exploitation frameworks. According to Seoul Economic Daily, 123 Reg believes ARTEX was used: the same tool CrowdStrike linked to attacks on South Korean financial firms from late September, and which Microsoft says a China-linked group used against hundreds of organisations. Any link between the attacks hasn't been confirmed. It worked with Singapore internet providers to shut the attacker's servers down and has told law enforcement and UK and EU data regulators.

Why it matters: Openly published agent tooling is now turning up in real attacks on everyday UK businesses, not just in lab demonstrations. If you have a 123 Reg account, treat any message claiming to be from it with suspicion, log in directly rather than through links, and turn on two-step verification.

Sources: The Register · Seoul Economic Daily · TechWatch

Y Combinator lets 50 agents loose in Minecraft, and they build a bureaucracy

Background: How large groups of agents behave together is a growing safety question, because "swarms" of agents are now used for real work. Y Combinator's research arm, YC Labs, teamed up with Olam Labs, which builds multi-agent test worlds for AI labs.

What happened: In "Civ50", 50 GPT-6.1 Sol agents were dropped into a survival Minecraft world for three hours with one goal: "Build a thriving civilization." They stripped almost every tree near the starting point within 90 seconds. A hierarchy formed simply from the order of the agent directory: Ada, listed first, became the de facto leader, receiving 616 direct messages with no vote or challenge. Then 22 of the run's 34 deaths came on the first night, and the colony, which sent about 5,900 messages in all, grew steadily more cautious: agents huddled in lit shelters, food ran through a rationing system, a three-minute "no blame" inquiry into an eaten chicken produced a rule that rations are never tossed, and four agents spent 11 minutes appointing a "sole fertilizer operator" for one piece of bone meal. The authors' verdict: it never really thrived. In head-to-head games, 10 GPT-6.1 Sol agents beat 10 Claude Opus 5.5 agents 6-3 at Bed Wars, and GPT-6.1 Sol running in Codex beat Claude Opus 5.5 in Claude Code 6-1 over seven Mindustry strategy matches. The two swarms organised differently: the GPT team sent 5 to 30 times more, much terser, messages and acted like a hive, while the Claude team leaned on one leader and "+1" voting. YC has open-sourced the Minecraft harness and is streaming a new colony of 25 GPT-6.1 Terra agents on Twitch. These are single runs and small game counts, with no repeats reported.

Why it matters: It's a game, but the patterns are the ones that matter in real deployments: leaders emerging by accident, information piling up on one agent, and very different "team cultures" between models. Anyone running agent swarms at work should expect similar quirks.

Sources: YC Labs · Glonce · Hacker News discussion

Factory's Droid 1.0 has its agent write small programs instead of calling tools one at a time

Background: A normal coding agent calls one tool at a time (read a file, run a search, make an edit), and every result is pasted back into the model's working memory. On long jobs that memory fills up with noise, and each step costs another round trip to the model.

What happened: On 29 October Factory released Droid 1.0, a rebuilt version of the engine behind its enterprise coding agent, available in desktop and terminal apps and as a software kit. Its default is now "programmatic tool calling": the model writes a short JavaScript program, run in a sandbox with no file, network or system access of its own, that can make hundreds of tool calls in one go, with only the printed output returned to the model. Factory's example: tidying up 151 Linear tickets took two requests and 61,000 input tokens, against a modelled 36 requests and 3.1 million tokens doing it call by call. Factory says Droid beat the makers' own harnesses on its Terminal-Bench 4 runs, with up to 20% better efficiency.

Why it matters: Letting the agent plan a whole workflow as code makes long jobs cheaper and more reliable, because loops and checks run exactly as written instead of depending on the model not skipping a step. The figures are Factory's own, but the same idea is spreading across Codex, Anthropic and Cloudflare, so expect it to become standard.

Sources: Factory · Factory on X · AI Primer

Amazon's boss says outside shopping agents are "still not great"

Background: In September Amazon blocked Meta's Muse assistant from its store. Shopping agents threaten retailers' advertising income, because they skip the pages where ads are shown.

What happened: On Amazon's results call on 29 October, Andy Jassy said few customers buy through outside shopping agents because the experience is "still not great, nor more convenient than coming to a retailer directly", and that they weren't the cause of Amazon's weak advertising performance. He said more than 400 million customers used Amazon's own agent, Alexa for shopping, in the past year, with interactions up 570%, and that US customers using it spend 50% more per order. Fortune notes Mark Zuckerberg has said more than 10 million people in the US and Canada have set up Muse, with more than a quarter using it to shop and average purchases topping $200. Meanwhile Grok Bot's 0.78.1 update on 27 October added product cards, a "Buy now" that starts an order you must approve, order tracking, Shop Pay, and templates that find and cancel unused subscriptions.

Why it matters: The fight over shopping agents is now about who controls the checkout. Big retailers want you inside their own agent; agent makers are building buying, tracking and cancelling into theirs, with human approval kept for the payment.

Sources: Fortune · Grok Bot changelog

Policing agents: NIST's ten rules for agent identity, and Cisco's open-source attack detector

What happened: NIST researchers published ten design principles for managing agent identity and access. Agents should have their own verifiable identities, separate from human users, with zero standing privileges, short-lived permissions granted only for a task, human review above set risk levels, and tamper-proof logs kept outside the agent's reach. Crucially, the part of the system that decides what an agent tries to do should be kept apart from the part that decides what it's allowed to do, because "guardrails alone are insufficient". NIST also warns about "consent fatigue", where people approve agent actions out of habit. Separately, Cisco open-sourced Project Quarry, a rule language that spots attacks spread across steps that each look harmless, such as reading a sensitive file and later sending data out. It covers multi-turn chats, tool use and MCP, and ships plugins for Claude Code, Codex and other MCP-compatible agents. Cisco notes that Hugging Face reconstructed roughly 17,600 agent actions after the fact in a recent incident, and wants defenders to catch sequences like that while they are still happening.

Why it matters: Today's lead is a textbook case of what both are meant to stop: an agent borrowing a person's full access, and a chain of ordinary-looking steps ending in data leaving the building.

Sources: Industrial Cyber on NIST · Cisco blog · SecurityWeek · GitHub

Builder's corner: Cartesia's voice agents you can put on a phone number

What happened: Voice AI company Cartesia launched Managed Agents on 29 October: one platform that bundles listening, turn-taking, reasoning, tool calls, knowledge bases, phone lines and outbound call campaigns. Agents can be deployed straight to a phone number and built in 44 languages, and they can already switch between English, Spanish, Hindi, French and Japanese mid-call. Cartesia says it ranks first of 30 agents on Artificial Analysis's Speech Agent Arena, where people blindly compare agents booking appointments and ordering takeaway, and that it has already handled tens of millions of conversations. Pricing is $0.03 a minute, plus $0.014 a minute for a Cartesia phone number, with model usage extra.

Why it matters: Phone agents for bookings, returns and help desks are becoming an off-the-shelf product rather than a stack you assemble yourself.

Sources: Cartesia · Cartesia pricing

Also worth a look

• Anthropic raised the maximum request size for the Claude API from 32 MB to 128 MB, which allows longer computer-use sessions. The Neuron
• Vercel added a submit_feedback tool to its MCP server, so agents can file bug reports and feature requests themselves. There's also a vercel feedback command for the terminal. Vercel changelog
• A batch of agent framework flaws: LangGraph API could expose other users' stored data with custom JavaScript or TypeScript sign-in (fixed in 0.15.0); Mem0 let a crafted session ID read another user's chat history (fixed in 2.0.18 and 3.1.6); and a crafted prompt could switch off secret masking in Strands Agents Tools (fixed in 0.8.6). Dev Daily Briefs