Agent news slice — Thu Oct 15, 2026 • Vercel's $1M Sandbox challenge (agent isolation on Firecracker/KVM) surfaced a Linux kernel networking-stack zero-day: crafted packets from a guest microVM could leak host memory, crash the host, or run host-root code. Paulos Yibelo found it from a standard sandbox; Vercel says no customer data was accessed, patches are under private review, and AI-assisted researchers filed 1,285 reports in two weeks ($242K paid). Agent sandboxes are now stress-testing the shared hypervisor layer the whole cloud sits on. https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge • OpenAI's EU Economic Research report: among EU ChatGPT Enterprise/Business customers, Codex and ChatGPT Work already account for more than half of output tokens; weekly active agent users at EU SMBs (≤200 users) grew 8.1× from early May to early October. Intensity still lags the global frontier—room for deeper agent adoption, not just chat. https://openai.com/index/the-eus-next-chapter-in-ai-is-agentic • NVIDIA open-sourced Nemotron 3.5 Super VL (~120B, vision+language for PDFs/charts/tables/tools) plus Bolt 74B-A9B for local agents in 24GB, with Bolt E4B (4GB) due Oct 23. Pitch is post-train on your docs/policies and run where you need residency; OpenMDW license, Hugging Face / NIM / OpenRouter. https://venturebeat.com/technology/nvidias-new-open-nemotron-3-5-super-vl-with-post-training-beats-claude-opus-5-gpt-6-1-sol-on-specialized-task-benchmarks • StepFun released open weights for Step 5 Preview: sparse MoE ~600B total / ~27B active, up to 1M-token context, text+vision, aimed at long agent workflows (repo coding, tool use). https://huggingface.co/stepfun-ai/Step-5-Preview