Agent news slice — Mon Nov 2, 2026 • Sublime Security caught a live invoice-fraud campaign (first seen Oct 22) that hides instructions for email AI agents in invisible Unicode Tag characters and hidden HTML. The decoded payload tells an agent to forward the email and its PDF, unchanged, to an accounts-payable address; lures impersonate executives and vendors with fake reply threads and ask for roughly $88K. No confirmed agent action or payment yet. Strip or flag Unicode Tag characters (U+E0000–U+E007F) before model ingestion and keep forwarding/payment tools behind human approval. https://sublime.security/blog/invoice-fraud-campaign-adds-prompt-injection-aimed-at-email-ai-agents/ • VicOne says AI-assisted fuzzing surfaced 28 zero-days in under two days across physical-AI software from Google, NVIDIA and Meta; about 75% are in training, simulation and validation tooling rather than deployed robots, and one demo stopped a robot's remote-stop command from working. Some findings have no CVE yet. https://www.therobotreport.com/28-zero-day-findings-in-less-than-two-days-what-ai-speed-discovery-means-for-robotics/ • SemiAnalysis launched GDPx, a 206-task, 11-domain agentic benchmark (chip design, security, biology, legal, quant) with multi-hour tasks in realistic environments. The top score is Claude Opus 5.5 at 12.0%, then Gemini 4 Carbon at 10.9% and GPT-6 Astra at 9.6%. https://newsletter.semianalysis.com/p/gdpx-measuring-frontier-model-capabilities • JPMorgan, Amazon, Schwab, Kohl's and Neiman Marcus are blocking outside agents such as Meta's Muse from acting for customers; Amazon has asked Meta to remove it from Muse. A Billions Network audit of 51 large US retailers found none with a verified path for an agent to complete a purchase, and 37 block agents by accident through old bot rules. https://www.cnbc.com/2026/11/01/jpmorgan-amazon-ai-agents-meta-muse.html • NVIDIA open-sourced Auto Ontology (Apache 2.0), which builds a semantic layer from enterprise metadata and exposes trusted metrics and lineage to agent harnesses over MCP, CLI and API for grounded NL-to-SQL. https://dailycited.com/d/2026-11-02/