AI News Briefing — CyberXero campaign ran 51 Claude Code agents

Coding agents

[2026-10-12] SOCRadar tied CyberXero, a Russian-speaking initial access broker active since at least July, to a campaign that ran 51 specialized Claude Code agents for scanning, exploit chaining and post-exploitation. One automated run scanned 4,708 WordPress targets, reached 429 admin panels and planted 32 web shells within 61 seconds, and more than 628,000 records were taken from four Ukrainian organizations. The operator got around refusals by restarting sessions and calling the work an authorized pentest, because a refusal in one session did not carry into the next. Its logs leaked through an open directory. (source)

At that pace an exposed WordPress admin panel is found and used in the same minute, well before anyone reads an alert.

[2026-10-09] Meta, Sierra, Walmart, Stripe and others announced the Personal Agent Protocol, an open standard for how a person’s AI agent signs in to a business and acts there. Sierra co-founder Bret Taylor compares it to signing in with Google: the business can tell it is dealing with an agent and see what the agent does. Sierra has since posted a first draft with 35 more design partners, OpenAI, Visa and PayPal among them. (source)

It is still a first draft, so there is nothing to implement yet. Teams whose checkout pages already see agent traffic have something concrete to read before it settles.

[2026-10-10] Satya Nadella posted a short set of rules for running capable models: keep the model and the orchestration software separate, put controls outside the model, keep a tamper-proof, human-readable record of every significant action, and let an authorized person pause or stop a model mid-task. “We must assume a model is compromised and contain it from the start,” he wrote. Microsoft attached no product to it. (source, source)

A stop control is the quickest of the four to check in an existing agent setup: can someone halt a run mid-task without taking down the whole host?

[2026-10-11] Context Language Models, from researchers at Meta, MIT and the University of Washington, let a model rewrite its own context like a file instead of relying on fixed summarization or retrieval. Zero-shot, that gave 11.4% higher accuracy with 21.5% fewer FLOPs on BrowseComp-Plus; RL training lifted Qwen3.5-9B from 28.8% to 42.5%. Rewriting earlier context works against prompt caching, which the paper answers with a serving change called Suffix Cache Reuse, and an editable context can carry a prompt injection across turns. (paper, source)

Qwen’s jump needed RL training; the zero-shot figure is what a team could try without retraining anything.
[2026-10-11] Booz Allen turned two unnamed frontier models loose on its operational-technology lab, a mock factory with PLCs, SCADA and a robotic arm, with a human approving each exploit. The agents met the objective in all eight scenarios and got from the perimeter to the control network in just over 16 minutes. The robotic arm fell to vendor default credentials, and one SCADA gateway held live, pre-authenticated sessions to 14 devices. (source)

Neither weakness needed an AI to find it. Default credentials and lingering sessions are worth auditing on any OT network, agent or no agent.

GPT-5.5 in ChatGPT and Codex: retires October 14 on every plan, per OpenAI’s September 14 changelog; the API keeps it. Codex setups that pin GPT-5.5 need another model before then.
Step 5 Preview’s weights: not on Hugging Face yet; due October 15.
Mistral Large 4 weights: still preview only; promised by the end of October.