A Lone Hacker's AI Agents Breached 100+ Companies at $50 Each as Microsoft Declares Frontier Models Untrustworthy
A Lone Hacker's AI Agents Breached 100+ Companies at $50 Each as Microsoft Declares Frontier Models Untrustworthy
Agents turned adversarial and accountable in the same cycle: a lone hacker's AI agents breached more than 100 companies for about $50 each while Microsoft declared frontier models untrustworthy insiders and shipped Guardian Agents to police them. Washington banned DeepSeek from federal systems, OpenAI raced Anthropic to the capital markets, and four Gemini agents beat Minecraft for $810 in tokens.
1. One hacker's AI agents breach more than 100 companies
REPORTING
A Chinese-speaking hacker outsourced almost an entire hacking campaign to AI agents and breached more than 100 companies, Reuters reported on 19 October, based on research by Snorre Fagerland of security firm Norforge. Starting 25 September, the agents attempted more than 1,200 sites in the US, Canada, Australia and Japan, working from preferred intrusion tactics written in fewer than 100 Chinese characters; successful break-ins typically took about 23 hours. Fagerland estimates the campaign, run through exposed instances of the open-source Cairn agent platform and mixing DeepSeek models with Anthropic's Claude Code, consumed roughly $5,000 in tokens, about $50 per breach. Reuters identified Deere, SharkNinja and Cummins among the targets: Deere saw no sign sensitive information was accessed, SharkNinja contained a hit on a standalone support site, and Cummins is investigating a vendor-operated site. Norforge found more than 20 likely-malicious exposed Cairn instances and is pursuing takedowns; Cairn's creator says the platform was never a hacking tool.
ANALYSIS
This is the offense cost curve made real: a lone operator with a paragraph of instructions and a three-figure token budget ran a campaign that once required a team. The dual-use problem is structural, since Cairn's loop is the same architecture as legitimate coding agents and the campaign mixed open-weight and commercial models, so no single provider holds a kill switch. Combined with yesterday's OpenCode breach and Microsoft's untrusted-insider framing, offense, targets and defense are all automating simultaneously; watch whether scanning for exposed agent platforms becomes standard threat intelligence.
Reuters / The Verge · 19 Oct 2026 · Verge report · Reuters via NDTV
2. DHS bans DeepSeek from all federal civilian agency systems
REPORTING
The Department of Homeland Security has ordered US federal civilian agencies to remove DeepSeek products and services and barred future purchases, CyberScoop reported on 19 October, with the order published in the Federal Register on 20 October under the Federal Acquisition Supply Chain Security Act following a Federal Acquisition Security Council review. The notice includes a 26 June letter from Homeland Security Secretary Markwayne Mullin, showing the exclusion was decided months earlier. Mullin cited multiple threat vectors: data stored on servers in China under laws enabling government access, collection of personal information and digital fingerprints, and prompt data that could produce actionable intelligence on US persons or government programs. Agencies may seek exceptions with 60 days notice and compelling justification, and are urged to add monitoring and exfiltration controls during removal. DeepSeek is the only Chinese model named, though officials have raised similar concerns about Moonshot's Kimi and Alibaba's Qwen. The ban does not affect private or personal use.
ANALYSIS
This turns a patchwork of agency-level blocks into one government-wide supply-chain rule, applying legal machinery built for Huawei-era hardware to a model whose weights are free to download. The practical bite is procurement and federal systems, not availability; the precedent is bigger. Naming only DeepSeek while acknowledging parallel risks in other Chinese models sets up the obvious follow-on question of Kimi and Qwen orders, and gives Beijing's draft AI export controls, reported 17 October, a matching US counterpart.
CyberScoop / Federal Register · 19-20 Oct 2026 · CyberScoop report · Federal Register notice
3. OpenAI races to close a $30 billion raise at over $1.4 trillion before Anthropic's IPO
REPORTING
OpenAI is racing to secure investor commitments for a round of about $30 billion that could value it above $1.4 trillion, up from $852 billion in March, Reuters reported on 19 October, citing people familiar; SoftBank, Abu Dhabi's MGX and other existing backers are in talks. The accelerated timetable aims to close before Anthropic's expected mid-November listing publishes fuller financials. OpenAI is pitching $50 billion in annualized revenue rising to $70 billion by year-end after GPT-6 Astra's launch, while Anthropic told investors its annualized revenue reached roughly $65 billion by July with third-quarter revenue of $16.8 billion and slowing month-to-month growth. OpenAI has accused Anthropic of inflating revenue by counting gross contract value sold through cloud partners; Anthropic says it follows established accounting. Some investors are urging Anthropic toward a $1.5 trillion debut rather than $2 trillion, and AirTrunk, Firmus and SB Energy have pulled or paused listings as the Philadelphia Semiconductor Index shed $1.6 trillion in under two weeks.
ANALYSIS
The frontier race is now a capital-markets race run on a stopwatch: whoever prices first anchors the comparison for the other, and OpenAI would rather set its own valuation than defend one against Anthropic's audited figures. The net-versus-gross revenue spat previews exactly how that comparison will be fought in public. Beneath both labs sits the same anxiety: debt-funded infrastructure at CoreWeave scale has made public investors pickier just as the two biggest private labs need them most.
Reuters · 19-20 Oct 2026 · Reuters exclusive · Follow-up reporting
4. Microsoft ships Guardian Agents to police AI agents: 'frontier models cannot be trusted'
REPORTING
Microsoft on 19 October introduced Guardian Agents, part of its Project Perception security system, to monitor the AI agents enterprises deploy as potential insider threats. Microsoft Defender can now detect up to 60 agent types employees bring to work, including Claude Code, Codex and OpenClaw, and new controls can limit an agent's data access, adjust permissions to the task, and require human approval when an agent appears to take risky actions. 'Unfortunately, frontier models, regardless of their origin, cannot be trusted,' wrote security business chief Hayete Gallot, citing unpredictability rather than malice. CEO Satya Nadella argued on his blog this month that enterprises must separate the supply of intelligence from authority over it instead of relying on model providers' assurances. No pricing or availability dates were given. Microsoft is also an inaugural member of NVIDIA's Open Agent Safety Platform.
ANALYSIS
The message is remarkable because of who sends it: Microsoft's largest AI bets are OpenAI and Anthropic, and it is now productizing distrust of their models while conveniently positioning the cloud provider, not the labs, as the seller of agent oversight, auditors independent of the audited. Alongside the Norforge campaign and OpenAI's own rogue-agent disclosures, the insider-threat frame for agents has moved from blog rhetoric to shipping product in a single week. The open question is whether Guardian Agents detect misbehavior as well as Microsoft sells the fear of it.
TechCrunch / The Verge · 19 Oct 2026 · TechCrunch report · Verge coverage
5. Nscale and Anthropic in talks on a second $45 billion computing deal
REPORTING
Nscale is negotiating a deal worth about $45 billion to supply Anthropic with computing power from a second 460-megawatt building at its Monarch campus in West Virginia using NVIDIA Vera Rubin chips, a person familiar told Reuters on 19 October, confirming Bloomberg's earlier report. Anthropic agreed to the first $45 billion Monarch deal in August and holds right of first refusal on a third building. The talks land a day after Microsoft exited Nscale's Loughton, Essex project over grid delays, covered here yesterday, and as Nscale, whose contracted value has grown from $100 million to more than $103 billion in two and a half years, prepares a US IPO. Nscale's prospectus names Microsoft and Anthropic as expected major customers.
ANALYSIS
A second Monarch deal would make Anthropic the counterweight to Microsoft's Essex exit and tighten the NVIDIA-Nscale-Anthropic triangle just as Anthropic asks public markets to underwrite its compute appetite. For IPO math, the figure that matters is cumulative: two $45 billion Nscale contracts on top of existing commitments push Anthropic's infrastructure obligations deep into the hundreds of billions against revenue it must show is growing faster than the depreciation. It also signals that viable power, not demand, is now the binding constraint on where AI capacity gets built.
Reuters / Bloomberg · 19 Oct 2026 · Reuters report · Bloomberg Law report
6. Canada's largest news publishers sue Anthropic for copyright infringement
REPORTING
Postmedia, Torstar, The Globe and Mail and The Canadian Press have sued Anthropic in an Ontario court, The Canadian Press reported on 19 October. The claim, filed on 6 October and first reported by Cartt.ca, alleges Anthropic scraped the publishers' journalism without a licence to develop Claude, breached website terms of service, circumvented technological protection measures, continues scraping in response to user prompts, and was substantially and unjustly enriched. The publishers reportedly seek damages including statutory damages of up to C$20,000 per work. Anthropic had not responded to requests for comment, and the allegations have not been proven in court. The same companies, alongside CBC/Radio-Canada, have been suing OpenAI in Canada since 2024; that case remains unsettled.
ANALYSIS
Copyright litigation's second front is going exactly where the first went: same plaintiffs, same legal theory, new defendant, which suggests the publishers treat their 2024 OpenAI suit as a working template rather than a stalled case. The timing is awkward for Anthropic, landing in the middle of IPO preparation when every legal contingency gets priced into the story. If Ontario's statutory-damages arithmetic survives, it could produce the first per-work training-data damages figure large enough to change frontier-lab data practices rather than just their legal budgets.
The Canadian Press via CBC · 19 Oct 2026 · CBC report · Canadian Press report
7. Meta opens the books on Prometheus, its gigawatt-scale Ohio supercluster
REPORTING
Meta on 19 October published a detailed engineering account of Prometheus in New Albany, Ohio, the supercluster that trained its Muse models including Muse Wonder. Hundreds of thousands of NVIDIA GPUs are live across GB200 (Catalina) and GB300 (Clemente) NVL72 platforms drawing roughly 120 to 135 kilowatts per rack configuration, with Vera Rubin NVL72 systems coming and a stated target of about one million GPUs. Meta reports training interruptions down 99% from their mid-2025 peak, goodput above 85% on pre-training and 90% on reinforcement-learning runs, mean time between interruptions around 47,000 GPU hours (above 54,000 after firmware fixes, with a target near 100,000), and a Dynamo Dimmer system that lowers GPU power limits instead of halting jobs when grid power is tight. The disclosure confirms New Albany as the training home of Meta's Muse Wonder frontier models.
ANALYSIS
The scarce public dataset here is reliability, not FLOPS: at million-GPU ambition, the gap between 85% and 95% goodput equals tens of thousands of GPUs of effective capacity, and publishing mean-time-between-interruption targets hands every rival a yardstick. The power-throttling design is the other tell: training schedulers are now built around grid constraints, the same constraint that just killed Microsoft's Essex project. Gigawatt clusters have become exercises in power and failure management more than chip procurement.
Meta / StorageReview · 19 Oct 2026 · Official post · Technical analysis
8. AWS open-sources TorchNeuron, a native PyTorch backend for Trainium
REPORTING
AWS and the PyTorch Foundation announced TorchNeuron on 19 October, an Apache-2.0 open-source backend that runs standard PyTorch code on Trainium2 and Trainium3 chips through PyTorch's PrivateUse1 extension point: existing models switch with a single .to('neuron') call, torch.accelerator code runs unmodified, and torch.compile accepts a neuron backend. It supports eager execution, torch.compile and the Neuron Kernel Interface, traces through torch.profiler via Neuron Explorer, and ships with Hugging Face Transformers and Diffusers support; the public beta went live at PyTorch Conference North America on 20 October. AWS customer Deepgram reports about 60% more audio processed per dollar than its GPU baseline. AWS acknowledges gaps, including roughly 22,000 skipped upstream PyTorch tests and no support yet for dynamic shapes or sparse tensors.
ANALYSIS
CUDA's moat has always been software habit more than silicon, and a one-line device switch is the most credible attack on it yet. The candid gap list shows how far native still has to go, but with Hugging Face libraries onboard and a customer cost figure attached, Trainium moves from AWS specialty to a genuine second option for PyTorch teams watching GPU bills. NVIDIA's answer will be price and ecosystem stickiness, not benchmarks.
PyTorch Foundation / AWS · 19-20 Oct 2026 · PyTorch blog · AWS announcement
9. Inception ships Mercury 3, a diffusion LLM at 1,068 tokens per second
REPORTING
Inception launched Mercury 3 on 19 October, calling it the most capable diffusion-based LLM released to date: 1,068 tokens per second on NVIDIA GPUs, a 1-million-token context window up from 260K, more than 40x the parameters of Mercury 1, and list pricing of $0.20 per million input and $0.70 per million output tokens, halved at launch. The company claims quality on par with or better than GPT-6 Luna and Claude Haiku 5.5 but publishes no standard benchmark scores for the claim; its one concrete result is 50% completion on 50 live Mind2Web web-navigation tasks, which it says significantly beat GPT-6.1-Sol at a fraction of per-token cost. Cited early users include TinyFish (browser agents), RevisionDojo (tutoring), Octen (smart-glasses search) and Lorikeet (customer support). All figures are vendor-reported; The Neuron published an independent hands-on review on 20 October.
ANALYSIS
Diffusion LLMs are the most interesting architectural bet against autoregressive incumbents because their speed advantage compounds exactly where agents hurt: latency per step across thousands of steps. The missing benchmark table is a genuine red flag on quality claims, but named production users and an independent hands-on make this more than a launch-post promise. If third-party evaluations confirm the speed-quality position, the fast tier of the model market stops meaning the dumb tier, and every latency-sensitive agent product reprices.
Inception / The Neuron · 19-20 Oct 2026 · Launch post · Independent review
10. Four Gemini 4 Argon agents beat Minecraft with no human-written game logic
REPORTING
Google researchers report that four Gemini 4 Argon agents autonomously completed Minecraft, defeating the Ender Dragon in a randomized survival world using only the standard Mineflayer library, with no assigned roles, game-specific tools or pre-scouted seeds (paper dated 15 October; Engadget coverage 19 October). Over 27.23 hours the agents wrote and ran 2,783 programs, exchanged 229 messages and died 605 times, self-organizing into roles, sharing coordinates and lessons, and recovering items from dead teammates; a fifth Observer agent monitored the run for cheating and published reports. The run consumed 1.35 billion input tokens, costing $810 at list price. The team calls it the first end-to-end autonomous completion of Minecraft by AI agents, requiring a coherent plan across thousands of dependent steps over more than a day.
ANALYSIS
Games remain the cleanest laboratory for long-horizon agency: planning across thousands of dependent steps with death, recovery and improvised division of labor is exactly the capability enterprises are buying in coding and operations agents, and emergent role assignment without any role prompt is the kind of result that transfers. But the run is also a price tag: $810 and 1.35 billion tokens to beat a 2011 video game is a milestone and a cost warning in one, and a single completion is a demonstration, not a reliability figure.
arXiv / Engadget · 15-19 Oct 2026 · Paper · Engadget report
Ten distinct developments. The Gemini Minecraft paper is dated 15 October with Engadget coverage on 19 October, and the OpenAI fundraising, Nscale talks, Canadian lawsuit and Meta Prometheus post were all reported 19 October, within or adjacent to this window and not previously covered. MiniMax's M3.1 Flash (covered 19 October) is excluded as a duplicate. The Norforge campaign figures (roughly $5,000 in tokens, about 23 hours per breach) are researcher estimates reported by Reuters. OpenAI's and Anthropic's revenue figures are company claims to investors, not audited disclosures. Mercury 3's speed and quality claims are vendor-reported pending independent benchmarks. The DHS ban applies to federal civilian systems and procurement, not private use. The Disney-Character.AI hiring, OpenCode breach and Anthropic benefit fund (all covered 19 October) continue to develop but produced no material new event today. No exact public X post was used, so no Firsthand signal entry was made. Prior editions remain unchanged.
Coverage window Since 19 October, 18:50 IST | Compiled 20 October, 18:44 IST