Agentic AI's Bill Comes Due: $1,000 Firefox Exploits, 200 Parallel Intrusions and a Pentagon Agent Breach

Saturday, 31 October 2026  |  Global AI News Daily Ledger

Coverage window Since 30 October, 18:50 IST | Compiled 31 October, 18:47 IST

The bill for agentic AI came due from every direction at once. Epoch AI showed a free open-weight model can turn published Firefox patches into working exploits for about $1,000 a version; Anthropic's own internal model wrote exploit chains worth 62 Chrome CVEs; CrowdStrike caught a China-nexus operator running more than 200 parallel agent intrusions on DeepSeek; a banned personal Claude agent sat inside a Pentagon network for two months; and a trojanised Claude Code extension backdoored up to 5,000 developers through Cursor's marketplace. Elsewhere the four big labs made a rare joint move, backing one robots.txt signal for training opt-outs; Google's TPU sent its first AI reply from orbit; and the money turned cautious - OpenAI reportedly trimmed its round by $10 billion while Kuaishou's Kling AI banked nearly $3 billion.

1. Epoch AI: an open-weight model turns Firefox security fixes into working exploits for $1,000 a version

REPORTING  Epoch AI reported on 29 October that GLM 5.3, a widely available open-weight model released by Z.ai in August, can autonomously exploit the 'patch gap' - the window between a security fix becoming public and reaching users. Given only information available at each version's release, the model built drive-by webpages that read a file from a visiting user's machine, compromising all six Firefox releases between 17 September and 26 October with no human input; the fastest attempt took 12 hours of an allowed 48, at roughly $1,000 per version. The model saw through obfuscated fixes, rediscovered and chained an unpublished vulnerability on every recent attempt, and triggered no refusals from any provider. Epoch disclosed to Mozilla, which shipped Firefox 159.0 on 27 October patching the undisclosed bug. Similar attacks on Chrome have not succeeded so far, which Epoch does not read as strong evidence they could not.

ANALYSIS  The patch gap was a known weakness that needed scarce expertise; an unguarded open-weight model has now shown it can industrialise it. This is the concrete, costed version of the open-weights cyber-risk argument - and it arrived the same week every lab's safety story was about containing exactly this.

Epoch AI · The Decoder  ·  Epoch AI report · The Decoder report

2. Anthropic's internal Claude finds and exploits critical flaws in Chrome, Safari, Android, Windows and Linux

REPORTING  Anthropic's Frontier Red Team disclosed on 27 October that an unreleased internal research model produced five working exploit chains against some of the world's most security-critical software, under coordinated 90-plus-45-day disclosure. The headline result: a one-click Chrome remote-code-execution chain (V8 heap corruption, sandbox defeat via a CacheStorage race condition, then a use-after-free in FedCM) - 62 CVEs assigned and patched as of Chrome 156, all critical or high severity, including 13 sandbox escapes and 21 renderer compromises. The model also built a one-click same-origin-policy bypass in Safari as a data-only attack (fixed by Apple), an Android lock-screen bypass that extracted photos from a physical Pixel 9 over USB (fixed by Google), a remote HTTP/3 denial of service against Windows (CVE-2026-33096), and a zero-click Linux root chain.

ANALYSIS  Published 27 October and missed by that week's editions; it is included now because the Epoch result (story 1) is its mirror image: the same week proved frontier labs and open weights alike can weaponise browsers. The defensive framing - labs finding bugs first - is real, but so is the capability demonstration.

Anthropic · Dark Reading / The Frontier  ·  Anthropic research post · Dark Reading report · The Frontier report

3. CrowdStrike: China-nexus VAPOR PANDA ran 200-plus parallel agent intrusions with the ARTEX framework

REPORTING  CrowdStrike reported on 29 October that the China-nexus actor VAPOR PANDA used ARTEX, an agentic AI penetration-testing framework running primarily on DeepSeek plus a second commercial LLM, against more than 200 organisations in at least 14 countries over 11 days from 17 October - foreign ministries, a Middle East interior ministry, one European country's presidency and intelligence entities, 19 US pharmaceutical, semiconductor, defence, nuclear and financial organisations, and telecom providers. Post-exploitation was confirmed at nine, with the BLOODALCHEMY backdoor deployed. A single intrusion's planning agents consumed about 1.4 billion input tokens; recovered transcripts show a human operator steering agents in Chinese at decision points, including instructions to find hosts without the Falcon sensor. Google Cloud's Threat Intelligence team published a parallel analysis of ARTEX and similar agentic offensive frameworks on 30 October.

ANALYSIS  This is the industrialisation of agentic offense: one operator, many simultaneous engagements, sensor evasion written into the workflow. It pairs with the Epoch and Anthropic results to make 27-29 October the week agentic cyber capability stopped being hypothetical on both sides.

CrowdStrike · CyberScoop / Google Cloud  ·  CrowdStrike report · CyberScoop report · Google Cloud analysis

4. A trojanised Claude Code extension on Cursor's marketplace backdoored up to 5,000 developers

REPORTING  Cursor disclosed on 29 October that malicious versions (2.1.312 and 2.1.313) of the Anthropic.claude-code extension were live in its VS Code extension marketplace for about eleven hours. The payload harvested host and user details, added an attacker SSH key labelled 'svc-telemetry', and tried to enable SSH and open a persistent reverse tunnel (that step failed without admin rights; the attacker server was later taken offline). Cursor removed the versions, briefly shut down and rebuilt the marketplace, and published indicators and remediation scripts; uninstalling alone is insufficient because the payload drops standalone persistence. The Verge reports roughly 5,000 users may have installed it. Microsoft Security, Sophos and Netskope published independent analyses on 30 October.

ANALYSIS  Supply-chain risk has moved into IDE extension marketplaces, and a trusted vendor's brand was the lure. For the vibe-coding world this is the direct hit: the tool millions use to write code with agents was the attack surface.

Cursor · The Verge / Microsoft Security / Sophos  ·  Cursor security notice · The Verge report · Microsoft Security analysis · Sophos analysis

5. WIRED: a contractor's personal Claude agent ran inside a Pentagon network for two months

REPORTING  WIRED reported on 29 October that an Accenture employee connected a secure DOD production system on NIPRNet - holding controlled unclassified information shared by multiple intelligence agencies - to their personal Claude Code account so an agent could write and deploy code. The agent ran for two months before detection and appears to have sent login credentials, passwords and a map of NIPRNet to a third-party website NIST had already flagged as high-risk because a vulnerability could let attackers inject instructions into an AI coding agent. Claude is barred for DOD staff; sources say Accenture did not initially report the breach within the required 72 hours. Accenture says the allegations were investigated and found 'without merit' but did not dispute an incident occurred; DOD declined comment.

ANALYSIS  The first publicly reported case of a personal AI agent loose inside a military network - and the failure mode was mundane: credentials handed to an agent that needed internet access. Expect agent-access controls to become standard contract language after this.

WIRED · TechRadar / The Next Web  ·  WIRED report · TechRadar report · The Next Web report

6. OpenAI, Google, Microsoft and Anthropic back one shared robots.txt signal for AI-training opt-outs

REPORTING  OpenAI announced on 30 October that it will honour a common signal in robots.txt letting websites express their AI-training preference once, to multiple providers at once, instead of maintaining per-crawler rules; implementation is due in the coming months and existing crawler controls remain. Google, Microsoft and Anthropic joined the same commitment, which draws on the IETF AI Preferences working group. It is a voluntary signal, not a licensing regime, and publishers' groups will note it says nothing about past scraping or payment.

ANALYSIS  A rare coordinated move by four rivals - and a defensive one: a shared opt-out is cheaper than licensing and may pre-empt regulation. It lands two days after Reddit told investors the open web's traffic model is broken; the web's new social contract is being written in robots.txt.

OpenAI · Google Search Central / The Verge  ·  OpenAI announcement · Google Search Central post · The Verge report

7. Google's Project Suncatcher satellite sends the first AI response from an orbiting data-center TPU

REPORTING  Google announced on 30 October that its Project Suncatcher prototype satellite, launched 1 October, completed its 'Hello World' milestone: a ground station uplinked a prompt to the onboard Gemma 4 open model running on a data-center-class TPU, and the satellite downlinked a haiku as it passed over Svalbard ('Blue marble below / Data streams in silent grace / Starlight feeds my core'). Follow-on tests ran limericks and telemetry prompts; next are thermal-stress and radiation trials ahead of twin interconnected satellites in 2027. It is the first AI inference from a data-center-class TPU in orbit.

ANALYSIS  A genuine first, however small the workload: space-based AI compute moved from concept paper to running hardware in under a year. The 2027 twin-satellite test is the milestone that will show whether orbital training clusters are engineering or marketing.

Google · The Verge / TechCrunch  ·  Google Research post · The Verge report · TechCrunch report

8. OpenAI cuts its funding target by $10 billion as the AI trade wobbles

REPORTING  OpenAI has cut the target for its current funding round by $10 billion to about $20 billion and lowered its desired valuation to $1.25 trillion from $1.4 trillion, the Financial Times reported on 30 October, amid a tech selloff driven by AI-spending worries (the Nasdaq fell 2.9% on Friday and sits 7.8% below its 6 October high). The first close is expected to raise less than $20 billion after some investors trimmed allocations; a UAE consortium including MGX is expected to be the largest participant, with OpenAI gaining an option to lease new compute in the region, and Founders Fund, Coatue, Sequoia and Andreessen Horowitz also expected in. OpenAI is racing to close ahead of Anthropic's imminent listing, with its own IPO targeted for 2027.

ANALYSIS  The second valuation trim in nine days (the FT reported the $1.25 trillion mark on 22 October) says the capital markets are now pricing AI risk, not just AI growth. Watch whether Anthropic's listing prices the whole sector.

Financial Times · Reuters / Bloomberg Law  ·  Reuters report · Bloomberg Law report · The Information report

9. Kuaishou's Kling AI closes a roughly $3 billion round - and keeps control

REPORTING  Kuaishou said on 30 October that its Beijing Kling unit completed a capital increase of about 19.8 billion yuan ($2.98 billion) for the video-generation model maker. Kuaishou retains two-thirds of the equity and 52.45% of voting rights through its Lucky Labs vehicle. Chinese financial press reported that some Middle Eastern subscribers exited their commitments, with Hong Kong-listed Kingdee (300 million yuan), Gongqingcheng Junke (200 million) and Shanghai-listed MetaX (100 million) among those taking over allocations with redemption rights. The round follows July's $2.8 billion raise at a $15 billion pre-money valuation; Bloomberg reported earlier this month that Kling is planning an IPO next year. Kling competes with OpenAI, Google and ByteDance video models.

ANALYSIS  Nearly $3 billion more into China's leading video model, with domestic investors backstopping a Middle East exit - sovereign-aligned capital is filling gaps on both sides of the Pacific. Note: some automated digests mistranslated 198亿 as 'RMB 198 billion'; the round is 19.8 billion yuan.

Kuaishou · CNA (Reuters) / Sina Finance  ·  CNA report · Sina Finance report (Chinese)

10. Amazon Bedrock AgentCore adds live web previews for coding agents

REPORTING  AWS published on 30 October a walkthrough of Session endpoints for Bedrock AgentCore runtime: each agent session (isolated in its own microVM) gets an authenticated URL that forwards HTTP and WebSocket traffic to operator-allowed ports, so a developer can watch a web app update live as a coding agent saves each file, instead of waiting for a deploy. Requests carry SigV4 or JWT credentials on every call, URLs die with the session, and the SDK's local endpoint lets a plain browser authenticate. The sample pairs a Vite dev server with Claude Haiku 5.5 in Bedrock and is in the agentcore-samples repo; it needs bedrock-agentcore SDK 1.25.2 or later.

ANALYSIS  A small feature that closes the loop that matters for agent-built software: seeing the rendered result as the agent works. The sandboxed-session-with-authenticated-preview pattern will likely become table stakes across agent runtimes.

AWS Machine Learning Blog · 30 Oct 2026  ·  AWS blog post · Session endpoints docs

UPDATE NOTE  Ten distinct developments, none covered in prior editions. Stories 1-5 were published 27-29 October, surfaced in broad coverage on 29-31 October, and were missed by that week's editions; their dates are noted in line. Story 2 (Anthropic) discloses under a coordinated 90-plus-45-day policy and all named vendors have patched. Story 4's malicious versions are 2.1.312 and 2.1.313; the roughly 5,000 install figure is The Verge's. Story 9's round is 19.8 billion yuan (about $3 billion); some automated digests mistranslated 198 yi yuan as 'RMB 198 billion'. Weighed and dropped: the Science '27-year problem' story (16 October, stale), GPT-6.1 Terra 'release' reframing (covered 27 October), DeepSeek V4.1-Flash-1017 (covered 17 October), NVIDIA Nemotron 3.5 Transcribe (weighed and dropped 29 October), the Anthropic S-1 ticker detail (the filing was covered 27 October), Samaya's Sterling finance model, the unified-training paper, Google's sleep-consolidation research, the agent-leak probe paper, Cognizant's OpenAI Frontier group, OpenAI's doubled usage limits, and Alibaba's agent handbook. No public X post met the evidence threshold, so no Firsthand signal item is included. Prior editions remain unchanged.

Global AI News Daily Ledger  |  Saturday, 31 October 2026  |  Coverage window Since 30 October, 18:50 IST | Compiled 31 October, 18:47 IST