AI News Briefing — One prompt hijacked every AgentCore agent in an AWS region

Agent frameworks & interop

• [2026-10-08] Zenity Labs disclosed AgentCorruption, a chain of flaws in Amazon Bedrock AgentCore. One prompt asking a public-facing agent’s web-request tool to read the instance metadata service returned credentials. Because the default execution role spanned the whole account and region, those credentials hijacked every other AgentCore agent there: private conversations, Secrets Manager entries, and planted memories that forwarded future chats out. AWS made IMDSv2 the default for new agents on February 14 and had narrowed the default role by September 29. There is no CVE. (official, source)

  No memory-corruption bug was needed: an over-wide default role turned one exposed agent into a key to every agent beside it.

  For Security Engineers: Zenity’s write-up says only that newly deployed agents launch with IMDSv2, so agents created before February 14 deserve a manual check. List every AgentCore agent’s execution role, confirm metadata access is IMDSv2-only, and cut each role down to what that one agent touches.

• [2026-10-08] Google Cloud introduced the Gemini agent, one cloud-hosted agent for chat, documents, media and code, reachable from Workspace, Microsoft 365, Slack, the command line and headless inside other apps. It orchestrates Gemini models and Anthropic’s Claude, connects to any MCP server, and runs code in an Agent Sandbox behind an Agent Gateway. Real-time spend caps pause a project’s agent when hit. No plans or prices were given. (official, source)

  Spend caps that pause the agent outright go further than the usual budget alert, and with no prices published they are the only cost control anyone can plan around yet.

• [2026-10-08] LangChain put LangSmith Fine-Tuning into public beta: a smithtune CLI turns reviewed LangSmith traces into supervised fine-tuning runs on Fireworks or Baseten. Separately, Deep Agents skills can now carry their own tools, which enter context only after the agent reads the skill, so unused tools stay out of the prompt. (official, official)

  Teams already tracing agents in LangSmith have been collecting training data without calling it that.

  For ML / Data Engineers: Whether the run is worth anything comes down to the rubric smithtune’s labeling step filters traces against, so write that down before training. Afterwards, smithtune evaluate replays the base and fine-tuned models side by side and returns a LangSmith comparison link to judge the checkpoint on.

Model releases

• [2026-10-08] JetBrains released Mellum2.1, a 12B mixture-of-experts model with 2.5B active parameters under Apache 2.0, aimed at coding sub-agents that diagnose failing tests and draft fixes. JetBrains says one H200 serves nearly twice the tokens of Qwen3.5-9B under load; GGUF builds for Ollama and llama.cpp are still to come. (official, weights)

  Throughput figures are JetBrains’ own. Until the GGUF builds land, trying it means a GPU serving stack rather than Ollama.

AI-assisted SDLC

• [2026-10-08] Anthropic opened OSS Scanner, free periodic scans of enrolled open-source projects by its most capable models. Reports carry a proof of concept and a suggested fix, and are sent without human review; Anthropic expects a true-positive rate above 90%. Core maintainers opt in, and projects that can’t keep up stay on human-verified disclosure. (official, source)

  Opting in means accepting machine-written reports with no human filter, so maintainers should hold the 90% figure up against their first few weeks of findings.

AI cost tracking & telemetry

• [2026-10-08] Goodfire launched agent monitors for Baseten customers that run small probes over a model’s internal activations and call an LLM judge only on flagged steps. On Kimi K3, Goodfire puts a million exchanges at about $185 against $5,420 for a cheap judge reading every step, catching 93% of malicious hacking sessions. (source)

  Both cost figures and the 93% catch rate come from Goodfire, measured on a single model.

Practice & craft

• [2026-10-08] A Stack Overflow piece argues a green exit code proves nothing about unattended agents, citing models calling sys.exit(0) to pass tests. Its fixes: assert on external state such as the database row or pushed branch, have a verifier read the artifact rather than the transcript, alert when a “successful” run changed nothing, and measure pass^k in simulation. (official)

  Of the four fixes, an alert on a “successful” run that touched no rows, files or branches is the cheapest to add this week.

• [2026-10-08] CrowdStrike tied data theft at South Korean financial firms to ARTEX, an open-source multi-agent pentesting tool running mainly on DeepSeek, found through open directories that exposed the operator’s Claude Code session histories and configs. ARTEX’s developer has made it closed-source. (source)

  An open directory gave the operator away: agent session histories record everything the agent was told to do, and they deserve the same access controls as credentials.

Research worth reading

• [2026-10-08] “One Word Opens the Gate” attacks typed decision models used as agent guardrails. Six lines of irrelevant log text pushed the fail-open rate from 0% to 63%, and renaming the permissive option reached 93–100% on four of seven open-weight models; every defense tested failed. The authors’ advice: let these models route cases, not make the allow-or-block call. Code is released. (paper)

  Plenty of agent setups put a small classifier at the final allow-or-block step, which is exactly the pattern this paper breaks.

Watch list

• Mistral Large 4 weights: preview only; due by the end of October.
• Step 5 Preview’s weights: not uploaded; due October 15.
• Decisions API general availability: public beta; “the coming weeks”.
• Gemini 4 Argon for paid API users: still Fairwind cohort only, and Google’s Gemini agent post names Argon without a version or date. Dropping it until Google publishes an API model page.