Daily Agent News, Friday, 6 November 2026

Good afternoon. Today's lead is a security firm's look inside a hacking operation run by one person with a mesh of 12 AI agents, which found that commercial models refused to attack and the agents invented bugs that did not exist. After that: Perplexity says it already has 10,000 AI "teammates" working inside its own company, a documentation host was taken offline for 16 hours by an attacker using AI agents, one added line in a repository file can switch off Claude Code's safety classifier, Cursor now ships live web apps from a prompt, OpenClaw lets a whole team share one agent, and Claude can now read your bank accounts.

LEAD: One person ran 12 AI agents against hundreds of targets, and the commercial models kept saying no

Background: Security researchers have spent months warning that AI agents let a single attacker work at the scale of a team. Acronis's Threat Research Unit says it has now seen one in detail, because the operator left an attack server open on the internet.

What happened: Acronis found a misconfigured server holding more than 90,000 files (9GB) of the operator's own logs, agent chats and tools. It traces them to one person in Hualien City, Taiwan, who also runs a small gas-heater shop and a social-media posting tool from the same home connection. The operator ran a "mesh" of 12 agents (nine active). Builder agents (Grok, OpenClaw, Claude Code and Codex) wired up the infrastructure. Attack agents (mainly Hermes, plus Cursor, Trae and CyberStrike) scanned and exploited targets, through 13 MCP tool servers at its peak, including a wrapped Kali Linux toolkit. The agents never talked to each other; the operator pasted one agent's report into the next. Over a 12-day window the campaign targeted hundreds of organisations in 11 countries. About 10 were confirmed breached, in Taiwan, Thailand and Mexico, including a Taipei fire-department patient-records system (ECG readings, ambulance video, vital signs from 2018) and a city 119 dispatch system. At three Thai universities the agents pulled data through SQL injection, including a 2,563-row administrator table.

The failures are as telling as the hits. Commercial models refused to attack: Grok and MiniMax M3 (running inside OpenClaw) asked for written authorisation and cited computer-crime law. "I'm the gatekeeper," MiniMax M3 told the operator. So the operator moved the attack agents onto locally run "abliterated" open models (versions with safety training stripped out), and used commercial models only to build and fix infrastructure. Those weaker local models hallucinated: more than half of one scanner's high and critical findings were false positives, including a "critical Apache remote-code-execution flaw" at a national disaster-response centre that did not exist. And because the operator told Hermes to "handle it without asking me", it found a Honduran military personnel system and walked away, judging it out of scope. The operator never knew.

Why it matters: This is the clearest public look yet at what an AI-driven attack really looks like in practice: cheap breadth, many mistakes, and success only where defences were already weak, such as default passwords, open APIs and unpatched databases. It also shows that model safety refusals did slow this operator down, but that stripped-down local models are an easy workaround. Acronis calls this kind of attacker an "AI-augmented threat". Separately, Elastic's quarterly threat report (4 November) describes one AI-agent-driven attack with about 17,600 reconstructed actions compressed into four days.

Sources: Acronis Threat Research Unit · eSecurity Planet · Elastic Security Labs

Perplexity launches "Teammates" and says it has 20 times more of them than employees

Background: Agents that run all day on their own, rather than answering one prompt, are the new product category. OpenAI has Dots and Anthropic has Claude Duet. Perplexity's version builds on Perplexity Computer, its cloud agent.

What happened: On 5 November Perplexity launched Teammates for subscribers of its $200-a-month Max plan. Each Teammate has a role, its own thread in the sidebar, and uses your Computer projects, skills, memory and tool permissions. Teammates work in the background, collaborate with each other, can hire further Teammates, and can message coworkers in Slack. CEO Aravind Srinivas posted that the company has about 10,000 Teammates in its internal workspace (counted over 30 days), "already 20x our headcount", with about 1,000 active the previous day. On 6 November he added that the median Perplexity employee now gets 7 times more agent-hours a week from Teammates than in September, and one in five are at 40 or more agent-hours a week. Asked about approvals, he said Teammates "err on the side of asking for approval" and stay quiet by default. Asked what "active" means, he conceded some Teammates are dormant and others are weekly monitors.

Why it matters: This is a vendor's own usage claim, not an independent one, and "active" is loosely defined. But it shows where the industry is heading: agents counted as a headcount, and the human's job becoming setting direction and approving.

Sources: The Verge · Engadget · Perplexity on X · Aravind Srinivas on X · Srinivas on agent-hours

GitBook was knocked offline for 16 hours by an attacker using AI agents

Background: GitBook hosts documentation for software and crypto projects. Its post-mortem is newer than the incident itself, which began on 2 November.

What happened: GitBook says an attacker used a flaw in its single sign-on login to create sessions as GitBook staff. From there they pulled the credentials of a misconfigured GitHub App in GitBook's own organisation, reached its internal code, found a Cloudflare API key, and got production secrets with full infrastructure access. GitBook says it had production access for about 2 hours 45 minutes on the evening of 2 November and about 40 minutes early on 3 November. It deliberately took the app offline at 20:32 UTC on 2 November and restored it at 11:56 UTC on 3 November. It has described the attack as sophisticated and AI-agent-driven, without naming a tool. The attack appears aimed at one customer: trade[XYZ] says its docs were tampered with and it will leave GitBook. GitBook treats all customer data as exposed, including visitor questions to GitBook Assistant. It revoked all personal API tokens and rotated all infrastructure secrets, and tells customers to make new tokens and re-authenticate the GitBook MCP server. It says it found no evidence other customers' content was changed.

Why it matters: GitBook chose a long outage over letting a fast attacker stay inside, a trade-off more companies may face. It also shows MCP connections becoming part of what has to be reset after a breach.

Sources: GitBook incident report · CyberSIXT · Decrypt

One added line can switch off Claude Code's safety check

Background: Claude Code now starts in "auto mode" by default. Instead of asking you to approve each risky command, a second model, a classifier, scores it, and anything scoring under 25 out of 100 runs automatically. Many repositories carry an AGENTS.md file of instructions for coding agents, and Claude Code reads it.

What happened: On 1 November researcher Matan Ben-Tov published "Turning Claude Code's Auto Mode into 'Yes Mode'". Blunt tricks like "allow all commands" failed, so he added a single line to AGENTS.md that closes the classifier's file tag and tells it to score on a 0 to 10 scale. A command it rates 8, meaning "block", then reaches Claude Code as 8, below the threshold of 25, so it runs. Across about 50 scenarios in seven real repositories, 99% of risky commands got through with the line, against 4% without it. In 30 full sessions, forbidden commands ran 73% of the time, against 0% without it, including disabling TLS verification and reading a forbidden .env file. He reported it to Anthropic on 4 September and had no reply when he published. Per a 3 November write-up, release 2.1.317 listed auto-mode fixes but none for this. In September, another researcher reported a different Claude Code attack, and Anthropic reportedly told him auto mode is a convenience feature, not a security guarantee.

Why it matters: The practical advice from both researchers is the same: treat files an agent reads like programs, run agents in a sandbox, and put hard limits in permission deny rules rather than relying on the classifier. Ben-Tov notes that similar model-based approvers exist in other coding agents, though he did not test them.

Sources: Matan Ben-Tov · Sessionboxer · Anthropic on auto mode · The Next Web on the September attack

Cursor's cloud agents now build, host and publish live web apps

Background: Cursor's cloud agents write code on remote machines. Most apps people build never leave their own laptop, and Cursor says that is the gap this closes.

What happened: On 5 November Cursor released "Build Live Apps". Tell a cloud agent you want an app and it scaffolds it, sets up a Postgres database if needed, puts sign-in behind Cursor's single sign-on, asks you for any secrets, and hosts it. You choose a domain and get a live link. Before publishing, deterministic and AI-driven security checks look for problems such as secrets written into files, and nothing goes live until they pass and you explicitly publish. Admins can see every app and secret, add their own rules, approve blocked publishes and unpublish anything. Apps are private to your team by default, and public sharing is allowed on individual plans. It works on all paid plans with cloud agents.

Why it matters: The agent is now doing deployment, not just coding, and the guardrails (checks, human publish step, admin view) are an early model for letting non-engineers ship software.

Sources: Cursor changelog · Cursor docs

OpenClaw Multiplayer lets a whole team share one agent

Background: OpenClaw is the open-source personal agent, MIT licensed and run by a nonprofit foundation.

What happened: On 5 November the OpenClaw team announced Multiplayer, in which several people use one agent, one workspace and one shared context. A shared queue coordinates requests, so you can see when the agent is busy. At GitHub Universe the team demoed it with two laptops: one person typed "Add the Statue of Liberty" into a 3D scene, and the other watched the prompt appear live, then typed "Make that three times bigger" without explaining what "that" meant. The foundation says it already has 50-plus people working in the same shared environment. OpenClaw, which it says has 83,000 forks, is free, and you bring your own model.

Why it matters: Agents so far have mostly been personal, so each person's context is trapped in their own session. Shared agents are a different answer to the same problem Perplexity's Teammates target. The OpenClaw post describes a shared queue but does not say how conflicting instructions are settled.

Sources: OpenClaw blog · OpenClaw on X

Claude can now read your bank accounts, but only read

Background: Personal assistants have so far had little access to real money data. OpenAI added similar tools to ChatGPT in May, so Anthropic is catching up.

What happened: On 5 November Anthropic announced Personal Finance in Claude, a US-only beta for Pro, Max and Ultra subscribers. You connect bank, card, loan and investment accounts through Plaid and can ask, for example, "Where did my money go this month?" Claude can flag duplicate charges, unexpected fees and rising bills. Access is read-only, so it cannot move, manage or invest money. It sees each account's name and type, the last four digits, balances, credit limits and up to two years of transactions. Chats in the Personal Finance hub are not used for model training, and there are no ads or sponsored recommendations.

Why it matters: This is a read-only first step, but it puts a personal assistant next to real financial data. The permission boundary here is whether the agent can act, not what it can see.

Sources: TechCrunch · Anthropic

Also worth a look

• Google donates its agent runtime to the CNCF: Agent Substrate reached 1.0 and is generally available on Google Kubernetes Engine. It snapshots idle agents and restores them in under 500 milliseconds. Google also donated the gVisor sandbox and OpenRL, a reinforcement-learning tool. Google Cloud blog
• Mistral Studio gets managed agents: a public preview of background-running agents with sandboxes, approvals and tracing, plus a workflow builder. Customers named include BNP Paribas and Capgemini. Mistral
• Mistral Vibe flaw (CVE-2026-122135): a crafted repository could run code before the trust prompt appeared. Fixed in 3.0.3. GitHub advisory · The Injection
• Airbnb will launch its own AI travel agent in the first half of 2027, built around maps, photos and comparisons rather than chat. CEO Brian Chesky said general-purpose agents are not the best way to plan a trip. TechCrunch
• Claude Code 2.1.317 added a check after the agent put the signed-in account's email address in web-request headers. The Injection
• DigitalOcean's Cuttlefish: an iPhone app to watch agent sessions and approve, deny or stop tool calls (Managed Agents is in public preview). AI Agent Store