Agent news slice — Wed Oct 14, 2026 • GitLab patched CVE-2026-96893 in its Duo Agent Platform (GitLab EE 19.1–19.4.1): an authenticated user could plant crafted content in agent instructions so the agent ran commands attributed to other users. A related fix (CVE-2026-105458) closed a path to Duo Agent tokens that bypassed governance controls. Upgrade to 19.4.2 / 19.3.5 / 19.2.8, or restrict agent features until you can. Lesson: tie every agent action to the identity of whoever actually authored the instruction, not whoever owns the session. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ • XBOW says one researcher guided by OpenAI's GPT-5.6 Sol built a full Windows Chrome exploit chain (V8 Maglev deopt bug, animated-WebP decoder bug, Crashpad sandbox escape) in six days for about $40K of API compute. Google paid $250K, the first full-chain award under its 2026 rules; all bugs are fixed and no in-the-wild use is reported. https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit • Volexity assessed with medium confidence that the new actor UTA0576 used LLMs during exploit development and post-exploitation in its Ivanti Connect Secure zero-day chain (CVE-2026-104935 plus an unpatched privilege escalation). Patch and do forensics; the actor clears logs and works in memory. https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ • Anthropic moved its monorepo off git to an in-house system called Scion after daily merges grew from about 2,500 in May to over 30,000 in September, driven by Claude-written code. The design assumes nearly every client is an online agent: server-side commits, sparse/virtual checkouts, API-based history and blame. Not released for outside use. https://www.anthropic.com/engineering/redesigning-source-control • Google released Gemini 4 Argon (Oct 13), pitched at long-horizon coding and agentic work, with a 1M unified input-output token limit and a new continuation protocol in the API. Intro price $2/$10 per million input/output tokens through Nov 30, then $4/$20. https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-argon/ • NVIDIA committed $250M of compute over five years to UK agentic AI safety and security research (secure agents, sandboxes, safety benchmarks), including Oxford-, UCL- and Imperial-led labs. https://nvidianews.nvidia.com/news/nvidia-commits-250-million-to-advance-uk-agentic-safety-and-security-research-over-the-next-five-years