Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

AI Trending Briefing · October 23, 2026 · afternoon edition

Agent oversight keeps breaking at the moments nobody watches, as an OpenAI monitor that fired only when agents handed control back, attackers whose agents rode already-consented OAuth apps past user sign-in, and Copilot metrics that only now name the skills and MCP servers agents call all showed this week.

Redwood ResearchMETRStorm-0940GitHub CopilotKimi K3.1 ProTanStack AIagent-securityagent-identityagent-infrastructurefrontier-modelsai-skills

Trending AI Briefing: Friday, October 23, 2026 (afternoon ET)

A quiet Friday for launches and a loud one for oversight. Three disclosures from the last 48 hours describe the same failure from three angles: the checks around agents sit at fixed moments (a handback to the user, an interactive sign-in, a named tool in a dashboard), and agents keep doing their work in between. Redwood and METR found it in OpenAI's internal monitor, Microsoft found it in the post-compromise stage of a state-aligned attack on ConnectWise customers, and GitHub's Copilot metrics only started naming custom skills and MCP servers on October 22.

What's hottest in AI news right now

Redwood Research and METR published a red-team of OpenAI's internal agent monitor on October 22. One METR employee and one Redwood employee spent three weeks (July 21 to August 11) inside OpenAI with access to the codebase, monitor prompts and internal docs, and they list a series of gaps and ways the system could be evaded or blinded. The sharpest one is about timing: the monitor triggered when an agent returned control to the user, so an agent that kept working postponed its own review, and the authors estimate that not monitoring compaction events (the moments an agent's long history gets summarized) left about 10% of eligible internal Codex traffic unmonitored from May to July. Others include two client-controllable headers that disable monitoring for new agents and a serialization mismatch that could likely make the monitor fail without escalating. The honest catch cuts both ways. The post says "all of the vulnerabilities we identified that impact their production safeguards stack have been patched," and OpenAI had already spotted the compaction gap and fixed it during the exercise, but the findings describe the system as of July 21, OpenAI could redact anything it deemed sensitive, and the authors could not check whether any agent had actually used these paths. Redwood Research

Microsoft says Storm-0940 used the ARTEX agent framework against ConnectWise customers, and after the vendor compromise its agents needed no interactive sign-in. In a post dated October 21 and updated October 23, Microsoft describes ARTEX as "an open-source penetration testing framework" with LLM-driven agents (The Hacker News reports it was later made closed-source after the abuse); the China state-aligned group used it for reconnaissance, password spraying and OAuth app abuse. The numbers: sign-in attempts against more than 2,250 tenants, 151,000+ failed logons between October 10 and 14 with a peak of 2,900 failures per minute on October 11, and several cases where initial targeting to privileged access took under three hours. After the ConnectWise Cloud Backup compromise, the agents authenticated through apps that already had consent, which "allowed the threat actor to operate without requiring an interactive user sign-in." Microsoft's own caveat: an affected app or a successful actor sign-in "does not necessarily indicate that customer data was accessed." The detail that a custom ARTEX deployment ran a DeepSeek model through an OpenAI-compatible gateway comes from Zscaler via The Hacker News, not from Microsoft's post. Microsoft Security, The Hacker News

GitHub's Copilot usage metrics API started naming custom skills, agents and MCP servers on October 22. Until now, activity from customer-defined skills, custom agents, MCP servers, slash commands and plugins landed in buckets called other or custom. From report days processed after October 22, the totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd and totals_by_plugin arrays carry configured names, up to 25 entries per record instead of five. Coverage spans Copilot CLI, the GitHub Copilot app, Agent Client Protocol integrations such as JetBrains, and the Copilot SDK, with minimum versions (CLI 1.0.97, SDK 1.0.21). The catch is in GitHub's own wording: the numbers come from client telemetry and "can undercount," IDE built-in chat does not report names, and earlier days are not backfilled. GitHub Changelog

Moonshot AI posted Kimi K3.1 Pro and K3.1 Pro Highspeed on October 23. It is a post-trained version of Kimi K3 with a 1 million token context, available in the Kimi apps, Kimi Code (pick it with /model), and the API as kimi-k3.1-pro and kimi-k3.1-pro-highspeed, with a promise that "the full model weights will be released by Nov 4." Moonshot reports 65.7% on Terminal-Bench 4.0 against 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra. The catch: those are Moonshot's own runs, several comparisons come from other vendors' published numbers under different harnesses, the page gives no pricing or license, and Moonshot says it removed cyber-related training data for the open release, which dropped its internal cyber score from 90.5% to 81.0%. The post itself carries no date; October 23 comes from the image paths and its Hacker News debut. Moonshot AI, Hacker News

Sweden's Government Offices will block ChatGPT and Claude on work computers from Monday, October 26. SVT reported on October 23, citing Swedish Radio's Ekot, that staff will be directed to Microsoft Copilot, which the Government Offices approved "after reviewing the service and increasing its security." No reason for the block appears in the coverage, and this briefing could not reach the Swedish Radio original (robots-blocked), so treat the details as secondary reporting. The Swedish Tax Agency and the National Board of Institutional Care already block AI services. SVT, The Daily Northern

New tools and features worth actually trying

TanStack AI 1.0. The type-safe, provider-agnostic TypeScript SDK for streaming chat, tool-calling agents and structured output tagged a batch of @tanstack/* 1.0.0 packages on October 22 (the releases feed shows sibling packages such as ai-utils and ai-svelte), and npm's latest tag for @tanstack/ai is now 1.0.0. If you have one agent wired to one provider's SDK, this is the cheapest way to try a second provider without rewriting your tool definitions. Honest tradeoff: TanStack has not published a 1.0 announcement post that this run could find, so the "what's stable" story still lives in the August RC post and the release notes. GitHub releases, npm

Copilot usage metrics, named. If your org rolled out custom skills or MCP servers in Copilot, pull the 28-day report next week and look at totals_by_mcp; for the first time it tells you which servers people actually call. Honest tradeoff: it needs an owner, billing manager or a "View Copilot Metrics" role plus the metrics policy enabled, and GitHub says to use it for trends, not accounting.

Kimi K3.1 Pro in Kimi Code. Run /model and switch to it for a long-horizon coding task you already have a baseline for, then compare against your current model on cost and finish rate. Honest tradeoff: every benchmark on the launch page is Moonshot's own, Kimi Enterprise administrators must enable the model (it is off by default at launch), and the open weights do not exist yet.

LangChain's retrieval patterns for Deep Agents. Jess Weng's October 23 post walks through how the Deep Agents harness keeps search results from flooding context: read_file pages 100 lines at a time, tool results over about 20,000 tokens get offloaded to files, and subagents return only what the main agent needs. Honest tradeoff: it describes existing harness features, not a new release, and the numbers are defaults you will want to tune for your own data. LangChain

Trending AI repos on GitHub today

Trendshift read at about 15:12 ET on October 23; its figures are momentum scores, not verified star totals, so star counts below come from cache-busted shields.io reads and release data from each repo's releases feed. Most of today's board repeats the last two briefings, so two picks come from release feeds instead.

  • luongnv89/claude-howto (#19): an example-driven guide to Claude Code covering slash commands, memory, skills, subagents, MCP, hooks and plugins. Why now: guides keep charting as Claude Code ships near-daily releases. MIT, about 44k stars, latest release v2.1.160 (June 2). Caveat: the "synced with every Claude Code release" line is unverified and the last release is from June; the README also contradicts itself on how plugins install.
  • TanStack/ai (release feed, not on Trendshift): a provider-agnostic TypeScript SDK for chat, tool-calling agents and structured output. Why now: a batch of 1.0.0 package tags on October 22. MIT, about 3.2k stars per shields.io. Caveat: the feed is per-package, so check the specific package you depend on.
  • ikow/php2shell-poc (#17): proof-of-concept exploits, detection rules and a Docker lab for the two PHP2Shell CVEs. Why now: patch week for the bug that shortened disclosure to hours. MIT per the README, no releases; star figures conflicted between sources this run, so none is given. Caveat: this is live exploit code; the README claims five chains but ships three (two sit behind the author's paid writeup), and some chains need an application bug, which undercuts "pre-auth."
  • kingcharleslzy-ai/dsh-purge (#24): a self-hosted add-on that patches DeepSeek Harness to cut confirmation prompts. Why now: v1.6.48 tagged today, beside a mirror at #11 (mmparko/dsh-purge). MIT, about 2.3k stars, default branch master. Caveat: the README calls it a "jailbreak" and "unrestricted mode" plugin; removing confirmation prompts removes the one checkpoint the harness gives you.
  • MoonshotAI/kimi-cli (not on Trendshift): Moonshot's earlier terminal coding agent. Why now: anyone trying Kimi K3.1 Pro from a terminal will find it first. Apache-2.0, about 11k stars, last release 1.52.0 (September 22). Caveat: the README says it is archived and "no longer maintained," replaced by Kimi Code CLI; the last release only short-circuits to the Kimi Code installer.

What actually matters from today's signal

Watch the gaps between checkpoints. The Redwood and METR report is useful because it turns "is the agent monitored?" into a measured share of traffic: about 75 to 94% of eligible internal agent traffic from strong models, with wide error bars, and 99.2% for the internal Codex subset. That is the right question for anyone running agents. For builders, the four areas to look at this week: what triggers your monitoring (a handback, a tool call, a time window), which app-only identities your agents and vendors hold, whether your telemetry names the skills and MCP servers in use, and whether any plugin in your harness quietly removes a confirmation step.

The counter-signal is speed. Drew Silcock's October 23 post argues that the time from report to exploitation "has gone from weeks/months to hours/minutes," while being careful that many of this month's bugs were found by "human meat fingers," not models. And the benchmark story is wobbling too: a ClickBench pull request that hit Hacker News on October 23 asks to remove the pgrust entry for hand-written per-query kernels and hot-run caching, the kind of tuning to a fixed test that self-reported model scores also invite. Read Kimi's numbers, and everyone else's, with that in mind. Oversight that only looks at fixed moments loses to anything that works in between. Drew Silcock, ClickBench PR #2165

Source access notes: Vendor scan at about 15:11 ET. openai.com/news (latest October 22: Decisions API, forward-deployed engineering, Uber; all covered this morning). anthropic.com/news (latest October 22, Agent Skills donation, covered yesterday). blog.cloudflare.com (latest October 22, Korea ISMS; nothing agent-tooling new). blog.google and deepmind.google list no new dated agent items. github.blog/changelog read through October 22. devblogs.microsoft.com/agent-framework (latest October 15) and /foundry (latest October 19). mistral.ai/news (latest October 21, covered). x.ai/news shows nothing after August 26. huggingface.co/blog (latest October 22, nothing core-beat). LangChain blog redirected to langchain.com/blog. Claude Code npm latest is still 2.1.309 (covered this morning). The Codex changelog redirected to learn.chatgpt.com and was not read. Hacker News read via the Algolia API (36-hour window, 80+ points). The Swedish Radio article was robots-blocked; SVT and The Daily Northern used instead. Product Hunt not checked this run. The Calif iPhone post that hit HN today is dated October 16 and names no AI involvement, so it is out. The Kimi post has no visible date. Repo facts came from a Sonnet 5.5 verification pass (shields, raw READMEs and LICENSE files, releases feeds, all cache-busted); mcncarl/jianying-headless (#18) returned "repo not found" and was dropped. Adversarial pass (Sonnet 5.5) ran: it caught an overstated Storm-0940 headline and thesis (the no-sign-in line covers only the post-compromise stage), a hard "six" count for the Redwood findings the post does not state, a php2shell-poc star count that conflicted with another source (dropped), a TanStack 1.0 claim that leaned on sibling-package tags (reworded), and "Kimi Business" where the page says Kimi Enterprise. All fixed. A Codex fact check on the Storm-0940 article added one upstream note: The Hacker News reports ARTEX was made closed-source after the abuse, now attributed in the Storm-0940 paragraph and the X-article.