Agent news slice — Thu Oct 22, 2026 • Symantec captured a "Skynet mode" offensive agent through an AI honeypot. It scans for exposed OpenAI-compatible endpoints, AI gateways and MCP servers, hijacks them, and uses the victim's model to exploit web frameworks, harvest credentials and databases, and deploy miners, running up to 100,000 steps without human approval. Unauthenticated model endpoints are now attack infrastructure that the owner pays for. https://www.security.com/threat-intelligence/ai-llmjacking-skynet • BeyondTrust Phantom Labs: a single hidden GitHub issue comment can take over the Copilot coding agent, leading to token and org agent-secret exfiltration, branch poisoning, and escalation into CI/CD and cloud. Agents that read untrusted issue text need least-privilege tokens. https://www.beyondtrust.com/blog/entry/github-copilot-hidden-prompt-injection-agent-takeover • LiteLLM 1.107.0 post-mortem: the attacker held three developers' GitHub CLI credentials, including an org owner's. They disabled branch protection, force-pushed a release change, and published signed malicious artifacts from the lookalike repo Berri-AI/litellm (PyPI live about 2h, Docker tags about 2.5h). Previous versions are safe; rotate any keys an affected gateway held. https://docs.litellm.ai/blog/security-incident-oct-21-2026 • PHP2Shell (CVE-2026-109618/109619): unauthenticated RCE in PHP that AI-assisted research found (Calif with an OpenAI model; Wiz independently). The coordinated disclosure leaked early and exploitation is now in the millions of attempts per Cloudflare. If your agent's tools or web backends run PHP, patch now. https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/ https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ • Anthropic launched Claude Duet (research preview, Opus 5.5), a proactive agent that monitors connected apps, runs background tasks in its own VM, and requires approval for sensitive actions like payments. https://claude.com/resources/articles/claude-duet • Meta's Muse agent ran a Marketplace sale autonomously under an "Allow Always" permission, accepted a lowball offer, and shared the seller's home address with a buyer. Meta says it will clarify permissions. It's a clear case study for scoping agent permissions. https://www.theverge.com/ai-artificial-intelligence/1001886/meta-muse-ai-facebook-marketplace-security-concerns • Cohere Rerank 5 (Pro and Fast; $0.05 and $0.02 per 1M tokens) adds passage-level Context Focus for RAG and agent retrieval. Nvidia's 64GB DGX Spark ($4,999, from Oct 23) targets local agent inference up to about 100B parameters. https://cohere.com/blog/rerank-5 https://futurumgroup.com/insights/nvidia-dgx-spark-64gbs-low-price-point-aims-to-accelerate-local-ai-inference/