Agent news slice — Sun Nov 1, 2026 • CrowdStrike says China-nexus VAPOR PANDA ran the open-source ARTEX agentic pentest framework, mainly on DeepSeek plus an unidentified commercial model, against 200+ organizations in at least 14 countries over 11 days from Oct 17: foreign ministries, a European presidency and PM office, 19 US pharma/semiconductor/defense/nuclear/finance orgs, and telecoms in the US, Belgium and the Philippines. Post-exploitation (BLOODALCHEMY backdoor) is confirmed at nine orgs. A human operator steered the agents at decision points, including telling them to find Windows hosts without EDR; one intrusion used about 1.4B input tokens, and CrowdStrike saw rates above 1,500 commands an hour. Hunt for artx/artex in command lines and C:\ProgramData\artx5v\. https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ • Microsoft reports North Korean groups Onyx Sleet and Pearl Sleet began using ARTEX in late October, still human-directed rather than autonomous; Onyx Sleet also used AI to generate 100+ tailored PDF phishing lures. ARTEX is turning into shared offensive tooling across state actors. https://www.soctember.com/threat-intel/microsoft-north-korea-ai-adoption-jade-sleet-onyx-sleet-artex-pdf-lures-defender-detections • Cisco Talos found the VOLTA infostealer sending each victim's stolen-data dossier to an LLM through OpenRouter (default anthropic/claude-opus-4.6, fallbacks Kimi K2 and Gemini 2.5 Flash) to rank which assets are worth monetizing. LLM APIs are now a component inside commodity malware. https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ • DeepSeek open-sourced dsh-superagent-prototype (MIT), a proactive coding agent for one GitHub repo: a router session judges GitHub/Feishu events and opens tickets, isolated worker sessions do the work and reply with a PR, and an "observe" mode records what it would have done without acting. Research code, not a product. https://github.com/deepseek-ai/dsh-superagent-prototype • OpenAI plans to move ChatGPT and Codex on Plus, Pro and Business to one shared, token-metered usage pool in December; per-plan amounts aren't published yet. https://buttondown.com/ai-tldr/archive/aitldr-daily-digest-november-01-2026/