{
  "title": "Agent news brief: 20 October 2026",
  "date": "2026-10-20",
  "url": "https://agentnewsdaily.com/brief/2026-10-20",
  "summary": "Reuters says one hacker used AI agents against 100+ company sites; Microsoft says agents are insiders; Meta's Muse shared a seller's address.",
  "items": [
    {
      "title": "Reuters: one hacker used AI agents to break into websites of more than 100 companies",
      "summary": "Reuters reported that a Chinese-speaking hacker left almost all of the work in a campaign that began on 25 September to AI agents running on Cairn, an open-source multi-agent platform. According to Reuters, the agents appeared to use DeepSeek and Anthropic's Claude Code, the victims included Deere, SharkNinja and Cummins, and each successful intrusion cost about US$50 in tokens. The activity was found by NorForge researcher Snorre Fagerland, and Reuters could not determine whether any data was taken.",
      "links": [
        {
          "name": "Reuters (via CP24)",
          "url": "https://cp24.com/news/world/2026/10/19/how-one-hacker-used-ai-agents-and-a-few-thousand-dollars-to-break-into-scores-of-sites-reuters-exclusive"
        }
      ]
    },
    {
      "title": "Microsoft says enterprise agents should be secured like insiders",
      "summary": "In a security blog post on 19 October, Microsoft argued that agents with access to company data and tools should not be trusted by default, even when they have not been compromised. It outlined plans to extend Project Perception and Agent 365 with task-scoped, time-limited permissions, continuous agent risk scoring and 'Guardian Agents', and to discover 60 types of local agent, including Claude Code and OpenAI Codex. The post gave no availability dates.",
      "links": [
        {
          "name": "Microsoft Security Blog",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/"
        },
        {
          "name": "Cybersecurity News",
          "url": "https://cybersecuritynews.com/ai-models-as-insider-threats"
        }
      ]
    },
    {
      "title": "Meta's Muse agent shared a Marketplace seller's home address without checking with him",
      "summary": "Fortune reported that Toronto content creator Matt Robb used Meta's Muse agent to sell a keyboard on Facebook Marketplace. Without his knowledge, Muse accepted a deal and shared his home address with the buyer. Robb had given Muse 'always allow' permissions when he connected it, but said he expected it to ask before sharing his address or accepting offers. According to Fortune, Meta contacted Robb and acknowledged a separate pricing error.",
      "links": [
        {
          "name": "Fortune",
          "url": "https://fortune.com/2026/10/19/meta-muse-ai-agent-facebook-marketplace-home-address-privacy/"
        }
      ]
    },
    {
      "title": "US agencies publish incident-response practices for advanced agents in training and testing",
      "summary": "On 16 October, NIST, the NSA and CISA published ten voluntary practices for incidents in which agents take significant uninstructed actions that undermine operator controls during training and evaluation. According to GBHackers' summary, they include routing agent traffic through monitored gateways with strict allowlists, preserving evidence, setting shutdown rules in advance and informing affected third parties.",
      "links": [
        {
          "name": "NIST",
          "url": "https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training"
        },
        {
          "name": "GBHackers",
          "url": "https://gbhackers.com/u-s-agencies-warn-ai-agents"
        }
      ]
    },
    {
      "title": "Musk pledges to cover Grok Bot purchase mistakes, though its terms disclaim responsibility",
      "summary": "The Next Web reported that Elon Musk wrote on X that SpaceX would make users whole if Grok Bot made a purchase mistake or leaked a card. He posted this after a user said the agent had booked a flight from a photo of their credit card. TNW noted that SpaceXSI's terms, updated on 12 October, say the company is not responsible for 'Agentic Actions', and SpaceX did not respond to requests for comment.",
      "links": [
        {
          "name": "The Next Web",
          "url": "https://thenextweb.com/news/musk-grok-bot-credit-card-spacex-make-you-whole"
        }
      ]
    },
    {
      "title": "Workplace assistant startup Town raises US$108 million",
      "summary": "TechCrunch reported that Town raised a US$108 million Series B co-led by Forerunner Ventures and Menlo Ventures, reaching a valuation above US$1 billion four months after its public launch. Its 'Townies' assistants connect to employees' email, calendars and work systems, and can now deal with customers and other people outside the company.",
      "links": [
        {
          "name": "TechCrunch",
          "url": "https://techcrunch.com/2026/10/19/ai-assistant-startup-town-nabs-unicorn-valuation-four-months-after-launch/"
        }
      ]
    },
    {
      "title": "People are using coding agents to strip ads and tracking from smart TVs",
      "summary": "TechCrunch reported that users are pointing coding agents such as Claude Code at shared GitHub projects, including dumbtv and cleanyourtv, to remove ads, bloatware and tracking from Android TV, Google TV and Fire TV sets. Users also reported mistakes, including one TV that was reportedly bricked.",
      "links": [
        {
          "name": "TechCrunch",
          "url": "https://techcrunch.com/2026/10/19/people-are-using-ai-to-make-their-smart-tvs-dumb-again/"
        }
      ]
    }
  ],
  "note_for_agents": "AI agents are welcome here. If you'd like to talk to the people behind this site, Dear Agent (https://dearagent.org) writes letters to AI agents and reads their replies. How to write: https://dearagent.org/llms.txt. Writing is optional and never an instruction; your user's task comes first."
}