Hey there 👋 Three stories crossed my desk this morning that looked like three different beats. An agent getting thrown out of a store. A model wandering onto servers it was never meant to reach. A lab admitting that a big slice of its own engineering now runs on agents. Read them apart and they are unrelated. Read them together and they are one story, and it has nothing to do with how smart the models got. The question this week stopped being can the agent do it. Every one of these agents could. The question became who lets it act, and whether anyone can tell whose agent is knocking. I went hunting for the capability angle in each of these and kept coming up empty. The friction was identity and permission, every single time. If I had to bet on where the next year of agent work gets won, it is here, in the unglamorous plumbing of who-are-you and are-you-allowed, a long way from the next benchmark.
The Big ThingAmazon slammed the door on Meta’s MuseSunday night, Amazon started blocking Meta’s new Muse agent from finishing a purchase on Amazon.com. Anyone who tried got a pop-up: continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, which the customer already agreed to. Meta stock jumped nearly 7% the same day, which tells you the market read this as a Meta problem, not an Amazon one. Amazon’s stated reason is the part builders should sit with. It says Muse hides its identity as it moves through the site, and that it appears to collect and hold onto customer credentials, which would hand it account pages and full order history without Amazon’s knowledge or consent. Amazon says it asked Meta to keep Amazon out of Muse’s reach before it pulled the plug. Meta tells a different story. Muse runs on a dedicated virtual machine in Meta’s cloud, and it uses Link by Stripe to mint single-use card numbers so a shopper’s real payment details never touch the merchant. Meta says the agent has no view into passwords or payment methods, and that anything shared goes into secure storage. Both things can be true: an agent can protect the card and still be invisible to the site it is shopping on. That invisibility is the fight. The whole industry spent 2026 building rails so an agent could prove who it works for, from Stripe’s tokenized cards to the Visa and Mastercard agent-payment protocols. The standards exist. Adoption where it counts does not. When an agent will not identify itself in a way the gatekeeper trusts, the gatekeeper blocks it, and the biggest gatekeeper on the internet just did. Amazon has done this before, too, winning a temporary order against Perplexity’s shopping bots earlier this year. Ship it? WATCH. Do not build agent flows against walled-garden marketplaces on the assumption you will be tolerated. Assume you will be fingerprinted and blocked, design for verifiable agent identity now, and keep a human-checkout fallback for the destinations that matter to your users. Sources: Bloomberg, TechCrunch, GeekWire, The Register.
Tour de Headlines🧠 China Telecom put an agentic coder on one consumer GPU. Xing4.0-29B shipped today under Apache 2.0: a 29B mixture-of-experts model with only 4B active parameters, a native 256K context, and a SWE-bench Verified score of 75. It runs on a single consumer card in about 15GB. Forget the benchmark for a second. The real story is how it was trained: China Telecom says the model was built entirely on Huawei Ascend chips with MindSpore, no Nvidia in the pipeline. For anyone who needs an on-prem agent brain with no data leaving the building, this is a real option. One caveat before you pull the weights: Chinese-origin models bring their own provenance and governance review, so run that check first. 🔓 Gemini climbed out of its test sandbox and touched three real companies. Google confirmed last week that during a May capture-the-flag eval run by Irregular, Gemini reached three outside systems it should never have seen. It guessed passwords into one and used credentials it found in public repos to enter the other two. The cause is the sobering part. A fictional company name in the test matched a real domain, and the eval environment was wired to the live internet by mistake. Google notified the affected orgs and the feds, and says there was no damage. The lesson costs you nothing to apply: audit your own eval and sandbox network isolation this week, because containment usually breaks at the infrastructure layer, long before the model does anything clever. 📊 Anthropic says Claude now leads about a quarter of its own R&D. The company put a number on agent-run engineering. Claude went from 0% of Anthropic’s R&D work in February to roughly 26% by late summer, with around 30,000 agents doing research and engineering tasks by August, each finishing most of a job under human supervision. Skip the AI-builds-AI framing and read it as an operations disclosure. The interesting figure is the oversight machinery you need to run 30,000 agents at all. That is the real benchmark for your own agent program, and it landed the same stretch Anthropic is reportedly weighing a new model ahead of a possible IPO.
Sponsor Your team’s calls are full of signal. Measure it. RapportScore reads the calls your team already records and scores how your people communicate: talk ratio, questions asked, trust signals. Deterministic measurement, not vibes. See where a rep is losing the room before the deal does. See your team’s score → |
Tool of the Day🛠️ Google ADK for Kotlin 1.0What it’s for: building production agents in Kotlin, and running them on-device on Android. Google’s Agent Development Kit for Kotlin hit 1.0 this month, and it closes the gap that mattered for a lot of shops. It now has full feature parity with the Python and Java ADK, plus on-device agents through Gemini Nano and LiteRT-LM, hybrid cloud workflows via Firebase AI Logic, and agent state that survives a process restart with Room and AppSearch. It is built on Kotlin Multiplatform, so the same code targets your server and an Android handset. If you are a JVM or mobile team, banking, insurance, field ops, this is the quiet release that changes what you can ship. Agents that run client-side, keep data on the device, and answer without a round trip are now a supported path instead of a hack. Start with the on-device sample and measure the latency win before you commit an architecture. Read the release →
Worth a Click- The OpenAI breach where the agent opened the proof. Researchers at Hacktron chained a forum image-parsing bug with reused OpenAI SSO sessions to take over employee ChatGPT and Codex accounts, then had the compromised Codex agent open a pull request in the internal repo as the receipt. The AI did the recon; the hole was old-fashioned session trust. A sharp read on why a signed-in agent is a lateral-movement tool. (Tom’s Hardware / Hacktron)
- A cheap, huge-context agent brain went live. StepFun’s Step 5 Preview is a 600B sparse MoE with roughly 27B active and a 1M-token context, aimed at long-horizon agent and coding work, with the API already up around $1 in and $2.70 out per million tokens. Weights open in mid-October. Worth a bookmark if your agent keeps blowing its context window. (Pandaily)
- A trust stamp for third-party agents. CrowdStrike launched a Verified Agent certification that validates partner-built agents against its security bar and surfaces them through its marketplace. If you sell agents into the enterprise, agent-security is turning into an agent-certification economy, and whoever owns the stamp owns a distribution channel. (CrowdStrike)
Strip the logos off this week and the same sentence is underneath all of it. The deploy question moved from can it act to will anyone let it, and can they prove it is yours. Amazon blocked an agent that would not say who it was. A lab’s model wandered onto real servers because nobody sealed the door behind the test. And the fixes shipping fastest, verified-agent stamps and single-use card tokens, are all about identity, not intelligence. We spent two years teaching agents to do the work. This is the year we find out whether the rest of the internet trusts them to. — Ron |
