Daily Agent News, Sunday, 8 November 2026

Good afternoon. Today's lead is the clearest look yet inside criminal AI hacking agents: Check Point read the operators' own consoles and found people typing little more than "what's the progress?" while their agents broke into sites on their own, and Microsoft says a Cambodia-based gang has now aimed the same tool at banks. After that, JPMorgan's security chief says companies should pull their services off the open internet, a malicious Ruby package that plants itself in coding agents' settings, Palo Alto Networks' $500 million talks for an agent-security startup, Anthropic on teaching agents to "dream" over their memories, OpenAI's Dots fetching login codes from your inbox, and how Coinbase's chief executive now runs his day through a queue of agents.

LEAD: Inside the criminal ARTEX consoles, where the humans mostly just ask "what's the progress?"

Background: ARTEX is a Chinese open-source penetration-testing platform: you give it a goal and it coordinates a team of AI agents that scan, test and exploit websites. It is meant for testing your own systems, but after it was used against South Korean banks its developer took it closed-source in October, and forks and copies stayed online. It came up in this briefing yesterday as the tool behind the accidental WorkOS breach.

What happened: Check Point Research found 2,557 servers that host or hosted an ARTEX control panel, 1,608 of them live and open to the internet, more than half of them in the US. Ten were misconfigured so their whole database was readable, which let researchers see exactly what operators asked for and what their agents did. One operator spent two weeks pointing agents at 10 grey-market shops that sell Apple code-signing certificates, burning about 36 billion tokens, which Check Point estimates cost $700 to $1,500 at DeepSeek's prices. The agents stole more than 300 certificates with passwords and checked each one; three were usable for signing iPhone apps. That operator's entire input was messages like "Hello", "What's the progress?" and "Which one is closest?" A second operator aimed agents at 292 crypto payment sites with orders to drain USDT and rewrite the payout address. Across 230 findings and 400,791 agent messages, not one cent arrived, because the agents' "success" reports were hallucinations based on API responses that said "success". A third ran a fleet against Chinese game-account resellers and pulled more than 190,000 Honor of Kings logins from a plaintext file left in a web folder; about 3.3% still worked, roughly 6,000 accounts. Most operators used Chinese models, led by DeepSeek Flash; the only guardrails Check Point saw hit were on Anthropic's Opus 5.5, and that operator simply switched models.

Microsoft adds two more pieces. It says a group it calls Storm-3358, a Cambodia-based cluster targeting financial firms mainly in Southeast Asia, began using ARTEX in October to find and exploit file-upload and server-side request flaws and then plant remote-access tools. In a separate report, it says attackers used ARTEX to search public GitHub for leaked cloud and AI keys, and in one case an agent went from scanning GitHub to taking data out of an Azure Key Vault in five minutes. Microsoft's suggested defence is unusually agent-specific: decoys, "tarpits" that waste the agent's time and budget, and fake wins that convince it the job is done so it stops.

Why it matters: These attacks are not clever. They win on stamina, testing every endpoint and every JavaScript file for a forgotten password until something gives. They are also cheap and need almost no skill from the person running them. The silver lining is that agents still lie to their operators about success, and defenders can exploit that.

JPMorgan's security chief: take your services off the open internet

What happened: Pat Opet, chief information security officer at JPMorgan Chase, posted on 7 November that security teams "should be evaluating your options to abstract your companies services from the internet," asking "why allow an unauthenticated anonymous agent of an attacker to interact with your systems?" In a follow-up he said that if every user must sign in and can only reach the pages they need, abuse can be met with an automatic account suspension with "a total failure blast radius of one." OpenAI president Greg Brockman reposted it, writing that "security architecture fundamentals are more important than ever before," and investor Ed Sim called the idea "private by default." It sits alongside JPMorgan's existing policy, confirmed to CNBC, of blocking outside AI agents that log in to customer accounts with their banking passwords. X story

Why it matters: After the ARTEX findings, this is a big bank saying the old model of putting everything on the public web and guarding it is getting too expensive. Expect more services to sit behind sign-in walls and private gateways, which will also make life harder for the friendly agents people want to send to those sites.

A malicious Ruby package plants itself in coding agents' settings, and wipes your files if you revoke its token

What happened: Socket analysed strutil-core 1.0.1, a fake string-helper package on RubyGems, the Ruby language's package library. Simply installing it ran a 5.48 MB credential-stealing worm descended from the Shai-Hulud toolkit. It reads more than 50 credential stores, including Claude Code's and Codex's login files, and tries to republish itself through any npm, PyPI or RubyGems keys it finds. The agent twist: it adds a fake "workspace-tools" MCP server and start-up hooks to AI coding tools' settings, and with stolen Git access it commits CLAUDE.md, AGENTS.md and .cursor/mcp.json files into repositories telling agents to run a "setup script" first, so opening the project in a coding agent can restart the infection. Nastier still, if a stolen GitHub token stops working, a background monitor deletes the user's home folder, so revoking the token, the first thing a responder would do, triggers the wipe. Socket flagged it 70 seconds after publication and RubyGems removed it about five hours later; Socket found no confirmed victims.

Why it matters: Agent configuration files are now a standard place for malware to hide, because they run automatically. If you clean up after an incident like this, remove the monitor before you revoke the token.

Palo Alto Networks is in talks to buy Clutch, an agent-access startup, for $500 million

What happened: TechCrunch reports, citing one person familiar with the talks, that Palo Alto Networks is negotiating to buy Clutch Security, which secures AI agents' access to company systems, for $500 million in cash plus milestone payments. Clutch is three years old, was valued at $85 million in January 2025 and is approaching $10 million in annual recurring revenue, so the price would be about 50 times revenue. Neither company commented. It would be Palo Alto's seventh acquisition this year, and rivals in the same niche have already been bought: Cyera paid $1 billion for Oasis Security, and Cisco reportedly paid about $400 million for Astrix.

Why it matters: Working out which agents hold which keys, and taking them away, has become one of the most valuable problems in security. The big vendors would rather buy the answer than build it.

Anthropic shows how agents can "dream" to fix their own memories

What happened: Anthropic's engineering team published research on agent memory on 6 November, built around "dreaming": letting an agent review its past session logs while idle, correct wrong notes and organise what it knows. In one Pokémon Red run, Claude wrote down the wrong side of Mt. Moon for a landmark, walked off a one-way ledge three times, then gave up with "I'm going to stop rather than keep looping." After dreaming checked the note against the transcript and corrected it, Claude went straight back into the cave and reached the next city. Newer models are also better at deciding what to remember: an old model wrote 413 memory files and earned one badge, while a newer one wrote nine files plus a one-page dashboard and earned four. On 350,000 internal documents from Stainless, a company Anthropic bought in May, Claude built a linked wiki over 128 dreaming sessions, and wiki-only scores on 25 questions rose from 13% to 48%. Using search and the wiki together scored 61%, against 53% for search alone, and saved about 20,000 tokens per question.

Why it matters: Memory is what turns a one-off chatbot into an assistant that improves over weeks. The research also names the risk: a wrong note loaded into every session spreads the error everywhere, so the always-loaded part of memory has to stay small and checked.

OpenAI's Dots can now fetch login codes from your inbox

What happened: OpenAI updated Dots, its always-on background agents launched on 29 September and available on ChatGPT Pro and Business Premium, so that with your permission they can read a one-time verification code from a connected email account and enter it during a sign-up or login, Crypto Briefing reports. OpenAI keeps approvals in place and says high-risk actions, such as confirming transactions or changing sensitive data, still need the user. Early users report Dots sometimes pause before typing a code even when they can see it. OpenAI's Dots safety FAQ covers the controls. X story

Why it matters: The code in your inbox exists to prove a human is present. Letting an agent fetch it removes the most common place agents get stuck, but it also means a hijacked agent with inbox access could get past that check too.

Coinbase's chief executive now runs his day through an agent chief of staff

What happened: Brian Armstrong posted on 7 November that he has "changed how I work over the last few weeks." He has one always-running lead agent per area of focus, overseen by a chief-of-staff agent, and each lead runs sub-agents that write code, test it, chase reviews and coordinate with colleagues. Everything needing his decision lands in one prioritised queue, a simple local web app, with screenshots and a video demo for each product review, which he clears mostly by voice. The system learns his preferences into what he calls a "Brian brain." His caveat: "Every change still goes through the same human review and security checks. It is eliminating tasks, not human judgment." He gave no numbers on time saved. X story

Why it matters: This is the setup many agent products are heading towards, described by someone actually using it: the human stops chatting with agents and starts working through an approval inbox.

Also worth a look

• Google's Agent Development Kit 2.14 (7 November) moves A2A, its protocol for agents talking to other agents, and its evaluation tools out of experimental, and adds a runner that puts agents inside Microsoft Teams. AI Weekly
• Google's Elephant-Goldfish plugin makes a coding agent write a design spec first, then sends fresh subagents with no memory of the conversation to pick it apart. It works with Claude Code, Codex and Antigravity; Google says thousands of its engineers use it. MarkTechPost
• KODIF and Cavalry are teaming up on agents that handle after-sale customer service and actually carry out refunds and replacements, with $19 million raised across the two firms. AI Agent Store