Agent news slice — Sun Nov 8, 2026 • OpenAI partners with Hacktron to pentest its own systems, especially third-party connections. Hacktron builds AI agents for code review, penetration testing, and red teaming; OpenAI is expanding the firm’s access to frontier models through Daybreak Red. Agent-to-SaaS glue is now an in-house red-team target, not just a customer problem. https://openai.com/index/partnering-with-hacktron • OpenAI’s BioBasicsBench tests whether agents can do everyday wet-lab analysis. The 100-task set, built with Ligo, uses raw gels, plates, microscopy, sequencing, and instrument readouts. At the xhigh reasoning setting, GPT-6 Astra scored 66.7% mean reward versus 43.8% for GPT-5.6 Sol, with clear gains on multimodal reading and knowing when the data cannot support a conclusion — and documented failures where Astra still overrode controls or miscounted colonies. Progress marker, not unsupervised lab competence. https://openai.com/index/measuring-how-ai-agents-handle-wet-lab-science • DeepMind’s human-guided AI agents found two weaknesses in legacy 1024-bit RSA. The work, announced November 6 by DeepMind chief scientist Pushmeet Kohli, improves signature-forgery and batch-factoring attacks on obsolete RSA-1024. Modern RSA-2048 and larger keys are not affected. One theoretical signature attack was described as about 1,600 times faster than prior work under limited attacker-controlled input; a sandbox replay of an already-solved benchmark used 3.5 times less CPU. The signal is compressed cryptanalysis research cycles, not a break of current TLS. https://interestingengineering.com/ai-robotics/1600x-faster-google-deepmind-agents-expose-weaknesses-in-older-encryption-methods • Claude Code’s “don’t ask again” approvals leaked 2,539 secrets across public GitHub repos. Apiiro found that saving an approved shell command can write passwords and API keys into .claude/settings.local.json. Of 104,185 public copies, 1,122 held at least one secret; including shared settings, history, and agent chat logs, the total is 2,539 secrets in 1,994 repositories (379 database passwords, 43 SSH logins, 42 git/npm tokens, 23 AWS keys). One notified company confirmed a key was still live. The tool’s git-exclude protection is local to one machine and does not travel with the project. https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html