Microsoft says treat your AI agents like potential insider threats. Microsoft published guidance this week telling enterprises to monitor AI agents the way they monitor employees with privileged access - because, in its framing, frontier models cannot be trusted when connected to systems outside the lab's control. The concern is prompt injection and agent hijacking: a malicious instruction buried in external content that redirects what an agent does next. Microsoft is specifically flagging agents employees connect to third-party or unmanaged systems. The guidance arrives the same week a hacker demonstrated exactly that threat at scale. (TechCrunch)
Brief
Tuesday, October 20, 2026 · 5 min read
One hacker used AI agents to breach 100 sites
Good morning. A diffusion language model hits 1,068 tokens per second, a hacker runs 100-site breaches with autonomous agents, and Microsoft publicly warns that AI agents behave like insider threats. The tools people are building with are also, apparently, the tools people are breaking things with. That is not a contradiction - it is just Tuesday.
Today's reading time is 5 minutes.
Listen · Snippt Daily0:00 / 4:23
SECURITY
Automated hacking has existed for decades, but it has always required a human to script each step - until agents capable of reasoning through novel obstacles became cheap enough to deploy at scale.
Driving the news: A single hacker compromised more than 100 websites using a fleet of AI agents that operated largely without human direction, according to security firm Norforge. Reuters identified confirmed victims including John Deere, SharkNinja, and Cummins. The agents handled reconnaissance, exploitation, and lateral movement on their own. Norforge did not name the attacker or detail how the agents were orchestrated.
- Victims span industrial equipment, consumer appliances, and engine manufacturing - no single sector was targeted.
- The agents reportedly refused to analyze malicious code when asked directly, a safety guardrail that did not stop the broader attack.
Zoom in: For years, security researchers warned that agentic AI would lower the skill floor for attackers the same way it lowers it for developers. This appears to be the first publicly documented case of that at meaningful scale. The hacker did not need to write custom exploits for each target - the agents adapted. That changes the economics of a breach: one person, 100 targets, mostly automated.
- The same week, Microsoft separately published guidance calling AI agents 'insider threats' and warning enterprises that frontier models cannot be fully trusted when connected to internal systems.
- OpenCode, an open-source AI coding agent, was also hit this week - hackers stole API keys and ran up charges on users' accounts.
Why it matters: If you are building with AI agents that touch external systems - web scrapers, browser-use tools, anything that authenticates on your behalf - the attack surface is now the agent's decision-making, not just your code. The OpenCode breach shows API keys stored near agentic tools are a specific target. Audit what your agents can reach and what credentials they hold.
Bottom line: The barrier to running a hundred-site hacking campaign just dropped to 'own one capable agent and point it outward.'
The Verge ↗Get this every weekday
Two minutes, 7am ET. No fluff.
Also happening
Inception's Mercury 3 diffusion language model runs at 1,068 tokens per second with a 1M-token context window. Diffusion LLMs generate text by iteratively refining a noisy output rather than predicting one token at a time, which is why the throughput numbers look so different from standard autoregressive models. Inception says Mercury 3 leads competing models on 8 of 12 benchmarks in its own testing. The 1M-token context is the more practically significant number for anyone processing long documents or codebases in a single pass. Inception published the benchmark table; independent verification has not yet appeared. (MarkTechPost)
Anthropic is reportedly in talks with compute provider Nscale for a $45 billion infrastructure deal. If it closes, this would be the latest in a string of large compute agreements Anthropic has signed over the past year. Nscale is a GPU cloud provider; the deal would give Anthropic dedicated capacity outside the hyperscalers it already works with. TechCrunch reported the talks as ongoing, with no signed agreement confirmed. The scale - $45 billion - puts it among the largest single compute commitments any AI lab has pursued. (TechCrunch)
Amazon released TorchNeuron, a developer tool designed to run PyTorch AI apps on its own chips instead of Nvidia's. PyTorch is the open-source framework most AI models are built on, and it defaults to Nvidia's CUDA runtime - meaning most apps run on Nvidia hardware almost by accident. TorchNeuron is Amazon's attempt to make its Trainium and Inferentia chips a drop-in alternative for PyTorch developers. The tool handles the translation layer so developers do not have to rewrite model code. It is a direct challenge to Nvidia's grip on the developer stack, not just the hardware market. (TechCrunch)
The thread
Agents as attack surface, not just tool
Three separate stories today involve AI agents doing something their operators did not intend or could not fully control: a hacker's agents breaching 100 sites autonomously, Microsoft warning that agents connected to unmanaged systems behave like insider threats, and the OpenCode breach where stolen keys funded unauthorized agent runs. The pattern is not that agents are uniquely dangerous - it is that the same autonomy that makes them useful makes them a vector. Anyone building workflows where agents authenticate, browse, or execute on behalf of a user now has a security surface that did not exist two years ago.
From the publisher
Snippt
Image, video and voice tools in one place
On our radar
- Hackers breached OpenCode, an open-source AI coding agent, stealing API keys and using them to run up charges on victims' accounts - the AI tools the attackers queried refused to analyze the malicious code, which did not stop the theft.
- Goodfire researcher Nick Cammarata published a 26,000-word post arguing the field has been misreading how neural networks work internally, drawing serious attention from researchers according to MIT Tech Review.
- Nvidia open-sourced its Run:ai GPU orchestration platform under Apache 2.0, including a Kubernetes scheduler and GPU fractioning tools for teams managing shared compute clusters.
- Nace AI released Drex Max, a multimodal model that reads screenshots and text to make decisions for computer-use agents, scoring 67.59 on Decision Index 0.3.2.
- Hugging Face's policy chief pushed back on the idea of embedded AI evaluators - neutral observers placed inside labs - calling it a harder governance fix than its proponents suggest.
- OpenAI published work on improving model performance in low-resource programming languages including COBOL and SQLite, with new evaluations for software engineering tasks.
- Samsung's Pyeongtaek semiconductor complex, already home to three operating fabs, is expanding further to meet demand for the memory chips stacked inside AI processors, per MIT Tech Review.
- Some smart TV owners are using AI agents to strip manufacturer bloatware and disable tracking, effectively using agentic tools to undo the software their TVs shipped with.
AI worth acting on, in your inbox
Get AI Weekly every Friday: the AI news, tools and tactics that matter for marketers, sellers and creators. Two minutes, with audio.
You can change these choices or unsubscribe at any time. Privacy Policy