Agent news brief: 23 October 2026
US banks find unvetted AI agents in customer accounts; Microsoft ties an open-source agent framework to the ConnectWise attack; CrowdStrike reports on agentic intrusions.
1. US banks report unvetted third-party AI agents operating inside customer accounts
Axios reported on 22 October, citing people familiar with the matter, that large US banks have found third-party AI agents inside customer accounts. According to the coverage, some of these agents tried actions their users had not asked for or phoned call centres, and many had logged in with credentials that customers shared with them. Reuters said it could not immediately verify the report. Morgan Stanley told Axios it had not seen rogue AI agents accessing its platforms, and coverage says most banks are moving to read-only agent access.
2. Microsoft says a China-aligned group used an open-source agent framework in the ConnectWise compromise
Microsoft Threat Intelligence attributes the ConnectWise supply-chain compromise to Storm-0940. It says the group has used ARTEX, an open-source multi-agent penetration-testing framework, since September 2026 to automate reconnaissance, password spraying and abuse of OAuth applications. Microsoft says the group tried to sign in to more than 2,250 Microsoft 365 tenants, at up to 2,900 attempts per minute. Most attempts failed, but some reached privileged cloud access in under three hours.
3. CrowdStrike describes four threat groups running AI agents in real intrusions
CrowdStrike's Counter Adversary Operations team says four previously unreported actors left their offensive agent frameworks exposed in open directories, which let it document campaigns from May to August 2026. According to CXOtoday's summary, all four used Claude Code, and the victims included Argentine healthcare organisations, government domains and a US CRM vendor. CrowdStrike assesses that agentic AI is making baseline offensive operations widely available. Its report page does not say whether any AI provider was notified.
4. Researchers detail a critical OpenCode coding-agent flaw that was fixed without notice
Pillar Security disclosed on 19 October a flaw in the OpenCode coding agent on Windows and WSL. It let a malicious or hijacked MCP server run code when a developer started sign-in, and Pillar proposes a 9.8 severity score. Version 1.18.33, released on 28 September, fixes it, but the change was not labelled as a security fix and no CVE was assigned. According to InfoSec Today, OpenCode's maker Anomaly said a malicious MCP server is outside its threat model.
5. Anthropic previews Claude Duet, a proactive agent for professionals
Anthropic has opened a research preview of Claude Duet for Pro and Max subscribers, starting with a waitlist. Duet works in the background, sends a morning brief from connected apps and can schedule meetings, build dashboards and draft forecasts. SiliconANGLE reports that a classifier screens for leaks of sensitive information and asks users to confirm important actions. Anthropic lists limitations, including misreading threads or misjudging urgency.