Agent news brief: 8 November 2026
UK proposes powers over AI agent loss-of-control incidents; OpenAI agents find 948 Linux kernel flaws; DeepMind agents probe legacy RSA.
1. UK government seeks powers to regulate AI agent 'loss of control' incidents
The UK government has added a clause to the Cyber Security and Resilience Bill. It would let ministers set rules for essential services and digital providers on agent safeguards, notifying affected organisations, preserving evidence and government-led incident reviews, The Register reports. A government factsheet says the measures will go to consultation and need parliamentary approval, and are not yet in force.
2. OpenAI says its agent pipeline found 948 distinct Linux kernel privilege-escalation flaws
OpenAI published results from a mid-October run in which agents using an unreleased cyber model audited about 7% of the Linux kernel and produced working exploits for 948 distinct local privilege-escalation vulnerabilities. Decrypt and Interesting Engineering report that the run cost about US$1.21 million in API credits. OpenAI says human researchers reviewed the candidate patches and that it has sent hundreds of reports and patches to maintainers. OpenAI has withheld technical details of the new exploitation techniques it says the agents found.
3. Google DeepMind says human-guided agents found two weaknesses in legacy 1024-bit RSA
Google DeepMind says AI agents working under human supervision, with researchers from UC San Diego and Inria, found a faster signature-forgery approach and a cheaper batch-factoring method for 1024-bit RSA. According to Interesting Engineering, the roughly 1,600-fold improvement is a theoretical estimate, while a reproduction of a known attack used 3.5 times less CPU time. The coverage says 2048-bit and larger keys are not affected.
4. GitBook post-mortem describes an attack it believes was largely driven by automation and AI
GitBook's post-mortem says an attacker exploited a flaw in its single sign-on flow and a misconfigured GitHub App, then gained full infrastructure access. GitBook took the app offline for about 16 hours and rotated its secrets. It earlier called this an attack 'using AI agents', and now says the speed and precision pointed to automation and AI, which it presents as an inference. GitBook says the attack targeted one customer but treats all customer data as potentially exposed.
5. UK digital regulators say existing law already applies to personal AI agents
The Digital Regulation Cooperation Forum, made up of the CMA, FCA, ICO and Ofcom, issued a joint statement on the 'agentic economy', CIO reports. It says competition, consumer and data protection law covers personal AI agents, and that an agent's autonomy does not reduce the deploying organisation's responsibility to comply.
6. Amazon lets invited US customers shop by text with its Alexa agent
Amazon has opened text-message access to Alexa for Shopping to a small group of invited US customers. The agent can search, add items to the cart, buy, track prices and reorder past purchases, and reorders need approval. Amazon says it will reach millions more customers in the coming weeks. TechCrunch notes the launch follows Amazon's September block on Meta's Muse agent querying its site.
7. Meta adds Spaces to its Muse agent
Meta has introduced Spaces: focused, topic-based workspaces in the Muse sidebar that the agent builds from a user's description, such as a gift tracker or wedding planner. According to TechCrunch, Spaces can connect to third-party apps and update in the background. The launch came a day after Muse Voice.
8. Meta acquires Conductor, maker of an app for running coding agents in parallel
Meta has bought Conductor, whose software runs several coding agents, including Claude Code, Codex and Cursor, in isolated copies of a codebase. The price was not disclosed. SiliconANGLE, citing Axios, reports the team is joining Meta. Conductor's cloud service becomes read-only on 13 November and shuts down on 20 November.