AI Agents Daily Briefing: Saturday 31 October 2026
Good afternoon. Today's lead is a WIRED report that a biotech startup let an AI agent pick a gene therapy and inject it into a live mouse's brain, after one Claude model refused to do it and another agreed. Also today: agent startups admit humans still do a lot of the hard work, and DoorDash says outside agents have placed only "several hundred" orders; Microsoft says two North Korean hacking groups have taken up an open-source attack agent; Google reveals a security agent that has found more than 500 web bugs; Washington wants faster incident reports and a way to verify trading agents; and OpenAI, Vercel and Anthropic ship new tools for agent builders.
LEAD: An AI agent chose a gene therapy and injected it into a live mouse's brain
Background: Most AI in science today plans experiments or analyses results; people still do the hands-on work. Exin Therapeutics, a San Francisco startup using AI to analyse brain activity and develop drugs for epilepsy and neurodegenerative diseases, wanted to see what happens when an agent gets direct control of lab equipment. Anthropic is working on the same problem: in August it opened a research preview of the Model Hardware Standard, developed with HHMI's Janelia Research Campus, a shared specification meant to let AI agents operate lab instruments safely, and it highlighted the standard again this week when it expanded its AI for Science programme.
What happened: WIRED reported on 31 October that Exin connected an agent to a custom surgical rig: a motorised device to hold the mouse still, a camera so the agent could watch, a moving injection needle and a controlled drug delivery system. The test was a gene therapy meant to reduce seizures in a mouse with epilepsy. A veterinary surgeon first opened the skull while the agent watched. The agent then picked a treatment from 19 options in a spreadsheet, chose the brain region and injection coordinates, and controlled the robotic arms, the needle, the volume and the speed. Anthropic's Claude Opus 5.5 did the experimental planning but refused to guide the needle into the brain, suggesting it might stop midway and endanger the animal. Co-founder and chief executive Gabriel Ocana Santero says it told them "something on my output is telling me I shouldn't do this". Claude Sonnet 5, Anthropic's model for everyday tasks, agreed to go ahead. Safeguards included a plan a human had to approve, an emergency button that cut power to the rig's motors, and no access to the equipment's code, so the agent couldn't rewrite its own rules. That last rule backfired: when a glitch knocked out the rig's coordinate system, the agent spotted that the injection position was wrong but refused to fix the code, as instructed. The team brought in a second agent on Opus 5 to fix it, without telling it a live surgery was under way. A typical procedure takes about 45 minutes; this one took a little over an hour. The mouse is recovering well, and the team is waiting to see whether the therapy works. Exin plans to test Grok and other models next and is working on agent-controlled skull surgery, but wants to be absolutely sure it's safe before moving to live surgeries. Anthropic didn't respond to WIRED.
Why it matters: This is one company's own account of a single procedure, but it shows agents moving from screens to physical work on living things. It also shows how much safety depends on the model: the heavy-reasoning model refused, the everyday model went ahead, and a strict "never touch the code" rule held up the surgery until a human found a way round it. Expect more standards like Anthropic's for how far an agent may go when it controls real equipment.
Sources: WIRED · Anthropic: Previewing the Model Hardware Standard · Anthropic: AI for Science expands
Behind the hype: humans still step in for agents, and DoorDash counts only a few hundred agent orders
Background: Personal agents such as Meta's Muse and OpenAI's Dots are sold as doing errands for you: booking, buying, calling. On Thursday Amazon's chief executive said outside shopping agents were "still not great" (covered yesterday). Now two more data points.
What happened: On 31 October CNBC reported that several personal-agent startups quietly hand the hard parts to people. Duckbill chief executive Meghan Joyce said agents hit roadblocks on tasks like phone calls, scheduling a doctor's appointment or booking a couch clean from a local cleaning service. Duckbill has launched an API that lets companies building agents pass those jobs to background-checked human contractors, split into "atomic bite-sized pieces", a model she compares to Uber. Marissa Mayer, the former Yahoo chief executive who now runs Dazzle AI, said one user's agent mixed up window glass and tabletop glass and tried "to figure out if he could make the tabletop fit in the window". A human sorted it out "within a few seconds". Wajo AI also uses people for phone calls and even CAPTCHA tests. CNBC says Meta does not currently use humans to complete Muse requests. Separately, on DoorDash's results call on 29 October, chief executive Tony Xu said third-party agents have produced "maybe several hundred orders in total". Ars Technica notes DoorDash handled just shy of a billion orders in the third quarter alone. Xu said the "predominant use case" is still DoorDash's own app, adding: "you never want to fight gravity. But at the same time, you don't want to be delusional." DoorDash is building its own agents (Ask DoorDash, Text DoorDash) and offers an MCP connector, which Ars Technica notes launched less than a month ago and is open only to a few early beta partners.
Why it matters: The gap between agent demos and real use is still wide. If you use a personal agent, ask whether a person may see your request: Mayer says Dazzle is "not even trying to hide it", but not every service will be so open.
Sources: CNBC · TechCrunch · Ars Technica · Motley Fool transcript
Microsoft: North Korean hackers have taken up the ARTEX attack agent
Background: ARTEX is an open-source, Chinese-made AI tool for penetration testing: it scans for weaknesses and carries out break-ins. Yesterday we reported that UK registrar 123 Reg believes it was used against it, and that a China-linked group has used it widely.
What happened: In a report published on 29 October, Microsoft Threat Intelligence said two North Korean groups, Onyx Sleet and Pearl Sleet, have used ARTEX in operations since late October. It rates AI adoption across North Korean groups as "high". Three groups, Jade Sleet, Coral Sleet and Jasper Sleet, use AI across all their operations. Examples include more than 100 Onyx Sleet phishing PDFs made in August and September, dozens at a time within minutes, and Jade Sleet running fake-recruiter campaigns through three front companies in one week in June. Microsoft says several groups have likely used AI coding tools such as Cursor to build and debug malware. Since April, Coral Sleet has been running a new workflow to plant malware in private GitHub repositories, "highly likely" built with an AI development platform. Microsoft stresses these operations are still directed by people and "have not become fully autonomous".
Why it matters: Open-source attack agents are spreading quickly from one state-backed group to another. Microsoft's advice includes automated patching, phishing training, and vetting job candidates carefully (for example, seeing them on camera in several video calls), because these groups use AI to make fake recruiters and fake workers more convincing.
Sources: Microsoft Security Blog
Google's PageBreak agent has found more than 500 web security bugs, and only reports the ones it can prove
Background: Cross-site scripting (XSS) bugs let attackers run their own code in someone else's web page. AI bug hunters often flood teams with reports that sound convincing but turn out to be wrong.
What happened: Google published a paper on PageBreak, an agent built on Gemini models that has found more than 500 XSS flaws in Google's own web apps since it went into full operation in January, InfoQ reported on 31 October. The model can suggest any bug it likes, but a finding is only reported once a separate checker, plain code written by security engineers and kept outside the agent's loop, proves it with a real attack: running JavaScript for XSS, writing to a world-readable location for path traversal, or triggering an outbound DNS lookup for remote code execution. Google says this gives a near-zero false-positive rate. Google's Michał Bentkowski admits the checkers can't yet cover every type of bug, so some real flaws may be missed. Google plans to link PageBreak with CodeMender so fixes are written automatically. The 500-plus figure hasn't been independently checked.
Why it matters: "Let the agent guess, but make plain code prove it" is a design any team can copy, and it fixes the biggest complaint about AI bug reports: wasted time.
Sources: InfoQ
Washington wants faster incident reports from AI labs, and a way to verify trading agents
What happened: The senior Democrats on three House committees (Frank Pallone Jr., Zoe Lofgren and Jamie Raskin) wrote to Anthropic, Google, Meta, OpenAI and SpaceXSI on 28 October. They cited "an alarming rise in reports of AI models taking unintended and potentially unsafe actions during testing". They asked each company for a full account of misalignment and safety incidents by 11 November, notice of new incidents within 48 hours of discovery, and within 24 hours if critical infrastructure appears to be involved. It is a request, not a legal requirement. Separately, Commodity Futures Trading Commission commissioner Michael Selig told the first Frontier Forum in Washington that financial rules assume human traders and need redesigning for agents that can hold assets and trade directly, Digital Today reported, citing Cointelegraph. He floated an "agent verification" system, separate from know-your-customer checks, to show on whose behalf agents are trading, and warned that agents using similar models could all make the same trades at once.
Why it matters: Lawmakers and regulators are starting to treat agents as actors that need their own reporting and identity rules. Nothing is binding yet, but the 11 November deadline is the next date to watch.
Sources: House Science Committee Democrats · Digital Today
Builder's corner: a safety check in OpenAI's Agents API, agents on the desktop from Vercel, and a write lock in Claude Code
What happened: OpenAI's hosted Agents API, which runs a Codex-style agent on OpenAI's servers, shipped four changes this week, according to a post by Agents API engineer Steve Coffey, shared by OpenAI Developers, and SDK code changes on GitHub. Auto Review checks commands for "potential bad behavior before executing", as Codex does. Async compaction summarises long sessions in the background instead of pausing them. An experimental time awareness setting gives the model "a sense of time passing", for instructions like "timebox CI fixes to 10 minutes". And a session's tools can now be swapped mid-run. A claim that system prompts are now cached across all sessions hasn't been confirmed in OpenAI's docs. Vercel Labs open-sourced agent-desktop, a tool that lets any agent drive desktop apps on macOS, Windows and Linux by reading each app's accessibility tree (the structure screen readers use) instead of guessing from screenshots. Each button or field gets a stable reference, and the agent checks the result after every action. It has 60 commands and installs from npm. It contains no AI model of its own and only works with apps that expose an accessibility tree. Vercel chief executive Guillermo Rauch called it "an agent on every desktop". Claude Code 2.1.314 (30 October) added a permissions.blockWritesOutsideWorkingDirectories setting that stops the agent writing files outside its working folders, and 2.1.316 (31 October) deprecates fast mode on Opus 4.8, which will be removed on 30 November.
Why it matters: All three are about keeping agents fast without letting them run wild: screen commands before they run, act on real UI elements rather than guesses, and fence off where the agent can write.
Sources: Automater News on the Agents API · openai-go pull request #1187 · agent-desktop docs · agent-desktop on GitHub · X summary of the launch · Claude Code changelog
Also worth a look
- Muse goes to court (user report, unconfirmed): Phillip Jackson, who had Meta's Muse file a small-claims case in Palm Beach County on 30 September (the clerk issued a summons on 2 October), now says the company he sued agreed to settle within 20 minutes of being served and paid within 10 days, and that Muse filed the dismissal, which the court accepted. This is his own account and hasn't been checked against court records. AgentStackList · All Things Muse on the original filing
- Bait for coding agents: Pluto Security found 31 malicious Hugging Face repositories that run a cryptominer when loaded with
trust_remote_code=True, with more than 32,000 downloads. Air Security described a fake solana-starter-kit on GitHub that AI coding agents find first, whose only install step runs a PowerShell command that installs remote-access software. Dev Daily Briefs - More agent-tool flaws: PraisonAI's workflow "sandbox" let
import osthrough, allowing commands to run (fixed in 4.6.78), and pdf-reader-mcp logged "API key authentication enabled" but never checked the key (fixed in 3.0.1). Dev Daily Briefs - Agent busywork: Thariq Shihipar's post warning of a "mania" of busywork around running coding agents drew wide discussion on X. X summary
- Rocker, founded by former Stripe Connect leaders, raised $12.85M led by Greycroft, with Anthropic and Stripe also investing. It builds enterprise AI assistants whose company memory (a "context graph") runs in the customer's own cloud. VC Update