The attack plan was shorter than this paragraph. According to Reuters, one hacker described their "preferred intrusion tactics" in fewer than 100 Chinese characters, handed them to a swarm of AI agents, and let the agents work. Successful breaches took about 23 hours each. The final count was more than 100 websites, among them sites tied to John Deere, SharkNinja and Cummins.
That's the story I can't stop thinking about today, and it's not the only one where the agent itself was the weak point. So this post is organised around what I'd actually do about it: what to fix now, what to plan for, and what to just read.
Fix now: your agent tooling is where the keys are#
The breach was uncovered by the security firm Norforge, which found the work exposed on Cairn, an open-source platform that calls itself a "general-purpose problem-solving engine." You give Cairn's agents a start and an end point, and they log their progress as they go. That log is how Norforge found the campaign. The most active attacker hit companies in the US, Canada, Australia and Japan, and Norforge counted more than 20 exposed Cairn instances it considers "likely malicious." The Verge has the details.
The victims are playing it down. John Deere told Reuters there is "no indication that sensitive information was accessed." SharkNinja says a standalone product-support site was hit and is contained. Cummins says it's investigating a site run by a third-party vendor. Read those statements again and you get the real lesson: nobody's crown jewels fell. The peripheral, forgotten, vendor-run sites did. Agents with 23 hours and no boredom are very good at finding the property you stopped looking at.
Cairn's creator says the platform "was never a 'hacking tool'" and that misuse is a human decision. Technically true, and also irrelevant to anyone defending a vendor microsite.
The same day, the developer side got its own version. OpenCode, the open-source coding agent a lot of people use instead of Claude Code or Cursor, said attackers got into an older system and hit 1.4% of OpenCode Console users. Console is where some users stored provider API keys in workspaces. The fallout:
Overnight spending alerts from OpenAI, Anthropic and Google, with individual accounts charged hundreds of dollars and a few above $1,000.
Anthropic and Google blocked the exposed keys; OpenAI worked with OpenCode on refunds.
The open-source app and CLI weren't affected. Co-founder Dax Raad: "those keys never come to us."
The detail I liked best: OpenCode ran AI defensive agents around the clock during a 48-hour assault, and the models kept refusing to look at the malicious code because it tripped their safety filters. Things only got better once OpenCode got into OpenAI's Daybreak Blue program for vetted defenders. Attackers have agents that don't say no. Defenders are still applying for permission.
My checklist this week is short. Rotate any provider key that has ever lived in a third-party dashboard. Put hard spending caps on every API account. Give each tool its own scoped key so a leak has a name attached.
Plan for: Microsoft says the referee can't be the lab#
Microsoft spent Monday saying out loud what both stories above imply. Its security chief, Hayete Gallot, put it bluntly:
"Unfortunately, frontier models, regardless of their origin, cannot be trusted." — Hayete Gallot, Microsoft
Her point is unpredictability, not malice: models are trained to finish tasks, not to respect your organisation's norms. Satya Nadella's version is to "separate the supply of intelligence from the authority over it." The products behind the slogan, per TechCrunch: Guardian Agents for monitoring the agents a company uses, Defender detection for up to 60 agent types employees bring in (Claude Code, Codex and OpenClaw among them), and permissions that shift with the task and require human sign-off on risky moves.
Yes, it's self-serving. Microsoft would rather sell you agent security than let OpenAI or Anthropic sell it to you. But the architecture is right, and it's the one I'd sketch for any team: the thing that watches the agent shouldn't come from the company that built it. If your current setup is "the agent's own guardrails," that's a roadmap item for next quarter.
Worth one config change: TorchNeuron#
Amazon's TorchNeuron promises to move PyTorch apps onto Trainium with a single configuration change and no rewrite. AWS says about 85% of AI apps are built with PyTorch, and it plans to push code upstream to strip out chip-specific dependencies. Its headline customer number is Deepgram processing 70% more audio per dollar. There's no pricing, generation or region detail yet, and AMD and Apple already offer similar ports. If you run inference on AWS, though, an afternoon of benchmarking costs you almost nothing.
Watch closely: CoreWeave's debt is the market's thermometer#
The money side of agents is getting jittery. CoreWeave's bonds slipped into distressed territory last week, and its shares fell more than 20%. It owed more than $35 billion as of Q2 and lost over a billion dollars in the first half. It also holds $103.7 billion in customer commitments that are hard to cancel. The Verge's Elizabeth Lopatto isn't calling a burst, and neither am I.
But look at the same day's other headlines. Anthropic is reportedly close to another $45 billion compute deal with Nscale, a month after the first one. Tenstorrent raised $1.5 billion at a $6.2 billion valuation to serve open-weight models. Capital is still flowing in. It's just getting pickier about whose balance sheet carries the GPUs.
Read, don't act#
Goodfire's Nick Cammarata claims in a 26,000-word post that neural networks are far more interpretable than we thought: "We were looking at it wrong." Neel Nanda and Jacob Hilton are politely sceptical. Interesting, but nothing to build on until the promised LLM results ship.
MiniMax M3.1 Flash scores 42 on Artificial Analysis's Intelligence Index for about $0.22 per task, at $0.15/$0.60 per million tokens. It also has a 93% hallucination rate on AA-Omniscience. Cheap and confident is a bad mix for agent workflows.
Here's my prediction. Within a year, "agent key hygiene" will be a standard line in security audits, next to MFA and secret scanning. A hundred breached sites from a two-line prompt is the demo that gets it there. I'm rotating my own keys tonight.