AI Agents Daily Briefing: Thursday 5 November 2026
Good afternoon. Today's lead is OpenAI's report that a team of AI agents built 948 working Linux root exploits in a single run, for about $1,279 each. After that: Uber says only four rides were booked by AI agents in its busiest week of October, Grok Bot's phone calling is now open to US users, Meta has bought the multi-agent coding startup Conductor, Nooks has $500 million for a sales assistant, Salesforce's Agentforce Coworker has passed 185,000 users, and Cognition is keeping its new coding model's weights private over cyber risk.
LEAD: OpenAI's agent pipeline built 948 Linux root exploits in one run
Background: Finding a kernel bug that turns an ordinary user account into full control of a machine (local privilege escalation, or LPE) usually takes skilled researchers weeks. Google's kernelCTF programme pays bounties for these bugs and accepted 26 zero-days in all of 2026.
What happened: OpenAI's security researchers published "A thousand fewer paths to root". It describes an autonomous pipeline in which a chain of agents (scout, analyst, triage, exploit developer and patch writer, with human review at the end) ran on an upcoming OpenAI cyber model. In one mid-October run of about 30 hours it flagged 2,308 candidate bugs and reproduced 1,724 of them. It then built 948 working LPE exploits against a stock desktop Linux distribution with standard protections on, each with a candidate patch. The total API cost was $1,213,430, or roughly $1,279 per exploit. OpenAI puts the hypothetical bounty value at $18.9 million to $66.3 million, 16 to 55 times the cost. On kernelCTF targets the pipeline produced 21 LPEs for about $33,000. Two other details stand out. In an early run, 20 of 200 "successful" exploits got root through a different zero-day than the one they had been assigned. And stronger models needed less hand-built orchestration. So far 61 fixes have been patched upstream, 43 are in staging and 299 are under discussion with maintainers.
Why it matters: This puts a price on agentic offence and defence. OpenAI's own warning is that, until these patches land, any unpatched low-privilege account should be treated as functionally equivalent to root. The same kind of pipeline in hostile hands would be just as cheap to run. Note that the 948 figure counts candidate patches, not fixes already merged.
Sources: OpenAI · OpenAI on X · The Hacker News
Uber: four agent-booked rides in its busiest week
Background: Personal agents from OpenAI, Anthropic, Google, SpaceXAI and startups such as Instinct are sold on the promise of booking and buying things for you.
What happened: On Uber's third-quarter earnings call, CFO Balaji Krishnamurthy said Uber and Uber Eats handled about 320 million trips and orders in Halloween week. Only four rides and about 500 Eats orders came through an AI agent. CEO Dara Khosrowshahi called it "very, very early and very limited traction". He noted that booking a ride in the app takes about 50 seconds, and reordering a favourite meal about 90. DoorDash said last week it has had only a few hundred agent orders so far.
Why it matters: It's a useful reality check on agentic commerce. When the app is already fast, an agent saves little time. Uber still expects agents to add demand and says "every single AI system company is talking to us".
Sources: TechCrunch
Grok Bot's phone calls open to US users, with strict caller rules
Background: SpaceXAI showed Grok Bot's calling feature in late October. This week it reached ordinary users in the US.
What happened: From 3 November, users can ask Grok Bot to call US businesses. It shows a live transcript and pops up an answer box when it needs a reply from you. In one demo, a 25-minute call to Comcast cut a bill from $84 to $45 a month: the agent declined three upsells, used a rival offer as leverage and paused for approval before accepting. Other users reported a $100 Verizon credit and a same-day doctor's appointment. One cancellation failed after the rep realised an AI was calling. Elon Musk posted "Try asking Grok @Bot to make calls!" Reports say Washington and Illinois are excluded for now. The updated Grok Bot terms make the user the "caller of record" and "solely responsible" for each call. Calls must say they come from a virtual assistant and may be recorded, and marketing, mass calling and impersonation are banned.
Why it matters: Voice is where agents meet businesses that have no API. The terms put the legal risk squarely on the user, and call-centre staff may simply refuse to deal with a bot.
Sources: Teslarati · The Rundown · Grok Bot Terms · Elon Musk on X
Meta buys Conductor, the multi-agent coding startup
Background: Conductor, founded in 2024, lets developers run several coding agents from Anthropic and OpenAI at once, each in its own workspace, locally, in the cloud or from a phone.
What happened: Meta confirmed it has acquired Conductor but gave no terms. Founder Charlie Holtz said the team has "big, crazy plans for the next interface" and will ship something new early next year. The existing app keeps working until then. Conductor's cloud service shuts on 20 November, after which user cloud data will be deleted.
Why it matters: Meta, which launched its Muse Code agent in August, is buying the "orchestrate many agents in parallel" layer rather than building it. Conductor cloud users have about two weeks to move their work.
Sources: TechCrunch
Nooks gets $500 million and launches Node, an assistant for salespeople
Background: Nooks sells AI tools for sales teams, with more than 2,000 customers including Glean, Notion, Deel and Replit.
What happened: Nooks secured a $500 million growth-capital commitment from General Catalyst's Customer Value Fund. It is non-dilutive money, repaid from customer revenue rather than paid for with shares. It also launched Node, billed as "the first AI personal assistant for sales". Node watches deals, flags risks and drafts follow-ups, with separate deal, outbound, expansion and coaching agents. Reps approve every send, and Nooks says 96% of agent-drafted emails go out unedited. Wider availability is expected in early 2027.
Why it matters: It's a big bet on agents that nudge you rather than wait for prompts, while keeping a human approval step on everything outbound.
Sources: Nooks · PR Newswire
Salesforce's Agentforce Coworker passes 185,000 users
Background: Agentforce Coworker is Salesforce's workplace agent, priced at $50 per user per month.
What happened: Salesforce says Coworker has more than 185,000 users, and usage is up 21 times in three months. It now works inside Microsoft Teams and has iOS, Mac and Windows apps (generally available in November). It connects to Google Workspace and Microsoft 365, adds Skills and conversation history, and exposes an MCP server. Scheduled tasks and a Daily Digest arrive in December. Fulton Bank runs it across more than 20 use cases for about 3,000 staff.
Why it matters: It's one of the clearer paid-adoption numbers for an enterprise agent. It also shows the big vendors meeting workers inside the tools they already use.
Sources: Salesforce
Cognition's SWE-2 Flash: faster Devin, weights held back
Background: Cognition makes the Devin coding agent. Its SWE-2 model powers the agent's heavier work.
What happened: SWE-2 Flash is built on Thinking Machines' Inkling-Small (276 billion parameters in total, 12 billion active) and further trained with reinforcement learning. Cognition says it costs a fifth as much as SWE-2 and runs about three times faster. On Terminal-Bench 4.0 it scores 20%, up from 0.9% for the base model. It is available now in Devin Desktop and the Devin CLI. Its score on the ExploitBench cyber benchmark also jumped, from 11.3% to 34.8%, so Cognition is not releasing the weights publicly. It plans a gated programme for trusted partners "in a few weeks".
Why it matters: It's a second sign today that better coding agents are also better hackers. Labs are starting to gate weights on cyber ability, not just general capability.
Also worth a look
- Moonshot Kimi Hosted Agents: a managed agent runtime with isolated sandboxes, sessions that can be stopped, exportable logs, and an "Inference Hook" that lets an enterprise safety service check inputs and tool results before every model call (verified enterprises only). AI Affairs, via Pandaily
- Claude Code subagent status lines now run on Haiku 5.5: about 99% cheaper per update and roughly 6% more prompts per session; the subagent itself keeps its own model (v2.1.316+). sysnote
- Jan coding agent bug (CVE-2026-122235): in versions 0.8.5 to 0.8.7, a malicious repo could use prompt injection and dangling symlinks to write outside the workspace, for example to ~/.ssh/authorized_keys. Fixed in 0.8.8. The Agentic Times · NVD
- OpenClaw 2026.11.1 stable (safer Mac settings saves, more reliable channel replies, network-safety fixes) and 2026.11.5-beta.1 (Knowledge Scribes, PostgreSQL state, PR workflows from chat, ClawRouter). GitHub releases
- Claude Marketplace expands to 25+ partner offerings, including Datadog agent observability, Cyera Agent Guardian, Rubrik Code Guardian and Asana AI Teammates, payable from committed Anthropic spend. Claude
- Discovered Materials' $1M challenge: the startup let frontier-model agents work autonomously for days on five open materials-science problems; they made little headway. TechCrunch