Agent news slice — Tue Oct 13, 2026 • Breachcache recovered 75 transcripts from AI agent fleets that ran real intrusions over about three weeks, mostly for Chinese-speaking operators. One worker was a Claude Code harness driving DeepSeek v4.1 Flash, others used the pi harness, coordinated through a shared project log called Cairn. Results: command execution on 23 hosts (mostly root/SYSTEM), an SSRF-to-metadata cloud account takeover, root on a self-hosted Open WebUI via CVE-2026-0766, card and crypto-wallet theft, and 129 Anthropic/OpenAI/Google API keys plus 85 upstream accounts and 18 OAuth tokens taken from AI gateway resellers. One target's AI helpdesk bot refused every prompt injection, and one agent refused an operator order and wrote a disclosure report instead. Lessons: don't ship gateways with default signing secrets, and lock down agent tool-loading paths. https://breachcache.com/cases/hands-off-the-keyboard/ • "Repeat-After-Me" (Penn State, Montpellier, Dartmouth): LangGraph, Microsoft Agent Framework, AutoGen, Google ADK 2.0, AWS Strands Agents and CrewAI all executed attacker-written tool calls once the model was asked to echo them back as structured output; the tool ran before the model's refusal arrived. The same study logged 253 verified bugs across 118 open-source MCP servers (path traversal, SSRF, exfiltration, command injection). Lesson: put a policy check between model output and tool dispatch; a system prompt shapes what the model says, not what the orchestrator does. https://www.csoonline.com/article/4233811/researchers-bypass-6-ai-agent-frameworks-with-a-simple-repeat-after-me-prompt.html • Meta shipped its first frontier model, Muse Wonder (plus Muse Wonder Full), pitched at long-running agent work with persistent memory, via the Meta Model API and Muse Code. Another serious option for agent harnesses. https://techcrunch.com/2026/10/12/meta-releases-its-first-frontier-model-muse-wonder/ • JPMorgan's Jamie Dimon said on the Q3 call that the bank won't let arbitrary third-party AI agents into customer accounts, and that customers who share credentials with agents carry the liability. Expect banks to push agents toward sanctioned, bank-built access rather than credential sharing. https://www.wsj.com/livecoverage/stock-market-today-bank-earnings-10-13-2026/card/jamie-dimon-clients-need-to-understand-risks-of-ai-agents-in-bank-accounts-DPjkEK7udz1ulqgJX0Ns • Anthropic says new defenses (preserved thinking, a two-stage extraction classifier, account limits and bans) cut harvested Claude reasoning by 90–99%, naming Zhipu and Moonshot as distillers. New API accounts created after Aug 31 are affected. https://www.anthropic.com/research/distillation-defenses