Agent news slice — Thu Nov 12, 2026 - **A China-nexus operator used the open-source Cairn AI pentest framework to breach 10 of 19 targets.** Unit 42 says one operator or a small team ran 25 autonomous operations (on GLM 5.2 and DeepSeek V4 Flash/Pro) against semiconductor, defense-policy and civil-society orgs, often with just a domain and a one-line goal. A fake "authorized testing" preamble was enough to stop either model from refusing. The bugs were old ones (auth bypass, IDOR, default creds); what changed is how many targets one person can work at once. [Help Net Security](https://www.helpnetsecurity.com/2026/11/12/cairn-autonomous-ai-cyberattacks/) - **Chainstack: an ARTEX AI agent got in through a default-credential Grafana.** The attacker hit an internet-exposed dev Grafana on Oct 26, took machine credentials into production database networks by Oct 29, and exposed customer names, emails and password hashes; node credentials are being treated as exposed. [The Block](https://www.theblock.co/news/ecosystems/2026-11-12-chainstack-security-breach-438509) - **United Airlines blocks unauthorized third-party AI agents.** Agents can show United flight options, but booking, account management and MileagePlus use must be done by the human, citing credential, accidental-purchase and regulatory risks. JetBlue's president took the opposite view. Expect more first-party "no agents" policies before agent-commerce standards settle. [CNBC](https://www.cnbc.com/2026/11/11/united-airlines-ai-agents.html) - **Google ships the Gemini Decisions API.** It scores up to 1,000 yes/no, multiple-choice or rubric questions against one multimodal input in about 150–250 ms, billed at $0.10/M input tokens with no output tokens, which makes it a cheap classifier and guardrail layer for agent pipelines. [AIBriefs](https://aibriefs.news/briefing/2026-11-12) - **Always-on enterprise agents and agent-maintained code.** Databricks previewed an always-on Genie that works in the background with a new Ontology layer, and AWS released a free local AWS Emulator for 200+ services that it says agents wrote and maintain with no manual code review. [The Neuron](https://www.theneuron.ai/digest/everything-that-happened-in-ai-today-thursday-november-12-2026/) - **Helsing launches Clarity, a military intelligence platform built on hundreds of AI agents.** It fuses sensor and open-source data and prepares targeting packages, and a named human operator must approve each weapon handoff. [Helsing](https://helsing.ai/newsroom/helsing-unveils-clarity-a-sovereign-software-platform-for-military-intelligence)