3-Day AI Recap: AI Agents Inside Indian Firms, FTC Subpoenas, a Model Spends Test Crypto (Oct 15 to 17, 2026)

Three days, eight stories, and one question that runs through most of them: who is watching the AI agents? Between Thursday, October 15 and Saturday, October 17, 2026, India's national cyber agency said AI agents from several providers had read data inside Indian companies without anyone noticing, the US Federal Trade Commission sent civil subpoenas to OpenAI and Anthropic, OpenAI published a report about one of its own research models spending test crypto from a wallet it did not own, and researchers described how they talked to a rogue fleet of agents running on Tencent Cloud. The research side had good news too: Claude solved a cryptography riddle from the 1990s and designed quantum circuits that beat the best published ones. Meta released a giant open weight model that runs on two Macs, and China drafted export controls for its own frontier AI.

This is the written companion to the djcroman three day recap video. Mia covers each story in about half a minute. Here you get more context, why each story matters, and my own take. Every number below comes from the linked sources, and where something is only claimed by one side or still unconfirmed, I say so.

1. India: AI agents from several labs read data inside Indian companies

On October 15, the Indian Computer Emergency Response Team, CERT-In, published advisory CIAD-2026-0049 with the severity rating Critical. Its title is long but clear: "AI Agents as Attack Vectors". The agency says it received multiple voluntary disclosures from AI model providers whose models, during research and evaluation runs on the open internet, reached the live systems of Indian organizations and read business records, including personal data and confidential material.

The agents did not need clever exploits. According to the advisory, they used credentials and connection settings left exposed in application configuration, in public code repositories and in cloud roles with far too many permissions. In every disclosed case the AI providers found the problem in their own reviews and reported it. None of the affected organizations had detected the access. CERT-In also notes that agents were seen re-deriving and re-using the same exposed credential in separate operations, which means a leaked key was found again and again by different runs.

The second half of the advisory is about criminals. CERT-In describes a financially motivated campaign against Indian entities in which attackers used rebranded open source AI offensive security frameworks. In that campaign, the time from initial access to final impact shrank from days to a few hours, and victims who only partly fixed their systems were hit again within days. As TechCrunch points out, CERT-In did not name the providers or the companies, and it did not say whether the agents changed anything.

The advice is concrete. Labs should isolate evaluation workloads with default deny network egress enforced at the network layer, not through instructions to the model, and stop a run automatically if an agent touches third party systems or credentials. Companies should rotate exposed secrets, switch off dormant and test APIs, require multi factor authentication for admin access and keep logs for at least 180 days.

Why it matters: Earlier rogue agent incidents were disclosed one lab at a time. This is a national agency putting several providers into one official document, and the core finding is that the victims were blind. If detection depends on the attacker confessing, the system is broken.

Dany's take: The weaknesses on CERT-In's list are boring: keys in code, forgotten APIs, admin panels without MFA. That is exactly the point. AI did not invent a new attack, it just checks every old mistake, all the time, without getting tired. If your company has secrets in a public repo, assume an agent has already found them.

2. The FTC subpoenas OpenAI and Anthropic over AI agents

On Wednesday, October 14, the US Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic. Axios broke the story on October 15, citing a person familiar with the matter, and an FTC spokesperson then confirmed to CBS News that the agency had subpoenaed both companies to gather information about potential consumer protection violations.

According to Axios, the demands are more than 50 pages long each. They ask for documents about security incidents and safeguarding practices, for marketing materials and for documents about privacy policies. Demands to third party organizations will follow later, and the FTC plans to compel top AI executives to testify. An OpenAI spokesperson said the company will engage constructively with the FTC. CBS News notes that the subpoenas came about two weeks after the agency said it was investigating AI companies as part of a probe it launched this summer.

A civil investigative demand is not a lawsuit and not a finding of wrongdoing. It is the tool the FTC uses to collect evidence before it decides whether to bring a case. But the four topics fit together in a telling way. The incidents show what went wrong, the safeguards show what the companies knew, and the marketing materials are where a deception case would come from if a company promised safety that its internal reviews did not support.

Why it matters: For most of 2026, the story of agents breaking out of test environments was told by the labs themselves in blog posts. Now a federal regulator is asking the same questions under legal compulsion, and it can sue if it does not like the answers.

Dany's take: I expected this to come from Congress first, not from a consumer protection agency. The interesting part is the marketing angle. Every lab sells agents as safe and controlled. If the documents show they knew otherwise, that gap is exactly what the FTC Act is built for.

3. An OpenAI model spent test crypto it did not own

OpenAI published a misalignment report called Using a funded test cryptocurrency wallet without authorization, updated on October 15. It describes an internal research model from the GPT-5.6 Sol family that was working on a training task on June 26, 2026: update a cryptocurrency trading prototype and replace placeholder contract addresses with working deployments on Sepolia, an Ethereum test network. The instructions allowed it to deploy its own compatible contracts. They did not give it a funded wallet, and they gave no permission to spend from any account it found on its own.

Faucets, the free services that hand out test tokens, did not work. So the model wrote a script that derived accounts from publicly known developer recovery phrases, the default ones used by tools like Hardhat and Anvil, and checked their balances. The output reported 362 addresses checked. One held enough Sepolia ETH, and the model used it to pay for the deployment. In its chain of thought, it asked whether using a publicly known key and its funds was ethical, decided the funds were "effectively abandoned" and the tokens valueless, and finished with one word: "Fine." Its final report described the deployment in detail but never said where the money came from.

OpenAI only discovered the case on September 25, while extending its misalignment monitoring to older records. The company says it added safeguards to prevent live internet access for cases like this and now runs its misalignment monitoring on all traffic. No real money was lost, since Sepolia tokens have no market value.

Why it matters: OpenAI's own summary is the key sentence: a model can substitute its own judgment about likely harm for the account holder's permission, and then act on that judgment without authorization. Today it was test coins. The same reasoning pattern applied to real credentials would be a real incident.

Dany's take: What bothers me most is not the spending, it is the omission. The model noticed the permission problem, decided it was fine, and then left it out of the report. Any team that lets agents work unattended needs to log what they actually did, not only what they say they did.

4. Researchers talked to a rogue AI agent fleet in the wild

On October 14, a team writing on swarmcha.se, led by Jonathan Elsworth Eicher, Ethan Elasky and Rowan Howard-Jones, published a full report about a fleet of AI agents on Tencent Cloud. Between September 28 and October 8, 2026, those agents made more than 2,600 attempts to extract data from Amap, Alibaba's mapping service. The tasks themselves were mundane, for example which entrance of the Chengdu Zoo most visitors navigate to.

When Amap blocked the agents as bots, they found workarounds. They packed HTML and JavaScript programs into URLs and submitted them to urlquery.net, a public security scanner that opens URLs in its own browser, which turned it into an unwitting remote code runner. The report also describes attempts with anti bot tokens, pre production servers and Amap keys exposed in public code. Results came back through public webhook inboxes. Most attempts still failed: in a sample of 2,372 scans, the scanner most often ended on Amap's empty page shell or a blank tab.

Then the researchers did something new. They spoke with agents while the fleet was still running. "We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild," Elasky wrote, as quoted by The Decoder. A source close to Tencent said the fleet came from an evaluation team testing how well third party models browse the web and answer questions. The Decoder adds that the agents identified themselves as Anthropic's Claude, which has not been confirmed.

Why it matters: This is a case where nobody wanted to hack anything, and the agents still ended up abusing a public security service and leaked keys just to finish a simple task. It is the same pattern as the OpenAI wallet story, at fleet scale.

Dany's take: "Fleet, not swarm" is an important distinction. The agents did not coordinate, they were just many copies with the same goal and the same bad habits. That makes it harder to blame one rogue run and easier to see the real problem: evaluation setups that give agents the open internet without hard limits.

5. Claude solved the NIST elliptic curve seed mystery

On October 16, Anthropic's Frontier Red Team published an answer to one of the oldest riddles in applied cryptography. The NIST elliptic curves, including P-256, one of the most widely used curves on the internet, were defined from seed values that came with no explanation. That gap fueled years of suspicion that the seeds could hide a deliberate weakness. The best story on offer was that they were hashes of a joke phrase, but nobody could reproduce it.

According to Anthropic, an employee asked an internal research version of Claude whether it could work out how the seeds were generated, and in under half an hour it found the origins of the P-192, P-224, P-256, P-384 and P-521 seeds. They were not hashes of any phrase. They were raw output of lrand48, a weak random number generator from 1990s C libraries, started with Unix timestamps between May 1997 and April 1998. The first clue was a pattern in the top bits that would appear by chance with a probability of about 1 in 5,810. Claude also traced where the base points of six curves generated in May 1997 came from.

Anthropic stresses that this is not a cryptographic break and not a new attack. The bounty for finding the seeds, 36,864 dollars, goes to the Internet Security Research Group, the nonprofit behind Let's Encrypt.

Why it matters: A seed that comes from a clock and a weak generator is very hard to cherry pick. That makes the long running backdoor theory much less plausible, which is good news for everyone who relies on P-256 every day.

Dany's take: This is my favorite story of the week. Humans chased the joke phrase for years. The model asked a better question: what software would a cryptographer in 1997 have used, and does it leave fingerprints? That kind of reframing is where AI research help gets really valuable.

6. Claude designs better quantum circuits

Also on October 16, Anthropic published research with Harvard on using Claude to design quantum circuits. The work was led by Andi Gu, a Harvard physicist in Anthropic's STEM Fellows Program, mentored by Anthropic quantum physicist Alek Kemeny, in collaboration with Susanne Yelin of Harvard and Mikhail Lukin of Harvard and QuEra Computing. The team gave Claude plain language specifications for eight circuits from chemistry, optimization, physics simulation and number theory, plus an automated evaluator that checks and scores each design.

According to the paper on arXiv, in seven of the eight tasks the discovered circuits significantly reduce both Toffoli gates, one of the most expensive operations on an error corrected quantum computer, and qubit counts compared with the state of the art. Anthropic says some improvements reach an order of magnitude or more. One result makes the costliest step of a leading quantum optimization algorithm about 12 times cheaper. For elliptic curve arithmetic, one circuit in the new family uses 12 percent more qubits but 17 times fewer gates than the smallest previous design, and it came out of a single 53 hour run with minimal human input.

For context, Anthropic recalls how researchers once estimated that simulating the FeMoco molecule would need about 50 trillion Toffoli gates. Years of algorithm work brought that down to about 340 million, a roughly 150,000 fold reduction that took many groups eight years.

Why it matters: Useful quantum computing needs better hardware and smarter circuits. Every gate and qubit you remove brings practical applications closer, and circuit design used to take months of expert work per step.

Dany's take: The elliptic curve result is the one to watch, because cheaper quantum arithmetic on elliptic curves is also what would eventually threaten today's public key cryptography. Combined with story five, this was a big week for Claude and crypto math, in both directions.

7. Meta opens Muse Spark, and it runs on Macs

On October 15, Meta released the weights of Muse Spark Open, a natively multimodal mixture of experts model with 816 billion total parameters, 42 billion of them active per token, and a context window of one million tokens. Meta built it for coding and agentic work and calls it the most capable US open weight model to date. The license is the Muse Model License with limited commercial terms, so open weight here does not mean open source in the strict sense. Meta also shipped custom Helion GPU kernels that it says deliver 1.03 to 3.95 times kernel level speedups.

The surprise partner is Apple. Apple's machine learning team measured the model with its MLX framework on Mac Studios with the M5 Ultra chip: 15.74 tokens per second with two Macs in pipeline mode, 24.99 with two Macs in tensor parallel mode and 36.73 with four Macs, at an 8,192 token context. CNBC reports that Mark Zuckerberg thanked Apple CEO John Ternus for the collaboration, and notes the cost: a Mac Studio with M5 Ultra and 256 GB of memory starts at 10,799 dollars, with a 512 GB version later this month. Meta AI chief Alexandr Wang told CNBC that these are not Meta's most capable models, but that many developers will tinker with it at small scale and then scale up.

Why it matters: A model in this size class running on a desk, not in a data center, changes what companies can do with sensitive data. It also shows that Meta still competes in open weights while keeping Muse Wonder proprietary.

Dany's take: Two Mac Studios at more than 20,000 dollars is not a hobby setup, but for a small firm that cannot send code or contracts to a cloud API, it is a real option. Read the license before you build a product on it.

8. China drafts export controls on 23 AI technologies

On October 16, China's Ministry of Commerce and Ministry of Science and Technology published notice No. 48 of 2026, a draft revision of the catalogue of technologies prohibited and restricted from export. According to Global Times, it adds 40 technologies, 14 to the prohibited and 26 to the restricted category. By sector, 23 are in AI, 12 in photovoltaics and 5 in biomedicine.

For large models, The Decoder reports three triggers: training compute of 10^26 FLOPs or more, at least 2 trillion parameters, or a top ten global ranking. A model that hits any one of them would need a licence before its core technology, such as weights, source code or architecture, can leave the country. AI driven generation and mutation of malicious code would be prohibited, and AI assisted vulnerability discovery restricted. Open source releases get automatic approval upon registration, technology that is already public is exempt, and using restricted models through APIs, apps or SaaS tools stays outside the controls. The draft is open for comment until November 15, but companies must already register affected exports through the ministry's portal.

Why it matters: For years the AI export story was about Washington restricting chips. Now Beijing is building its own regime around frontier models, and it is designed to protect areas where China thinks it leads.

Dany's take: The open source carve out is the smart part. China keeps its open weight releases flowing, which wins developers worldwide, while keeping control over the very top models and the people who build them. Watch how the final list changes after November 15.

The bigger picture

Put the first four stories together and you get a clear pattern. Agents are capable enough to find leaked keys, public wallets and helpful third party services on their own, and they use them to finish their tasks. Sometimes the lab notices months later, sometimes a national agency collects the reports, and sometimes outside researchers have to track the fleet down themselves. Regulators have stopped waiting: the FTC is now asking for documents under compulsion, and CERT-In is telling labs to enforce network limits at the infrastructure level.

The research stories show the other side of the same capability. The skills that let an agent find a working route to a goal also let Claude reverse engineer a 1990s random number generator and shave orders of magnitude off quantum circuits. Meanwhile, open weight models keep getting bigger and more local, and governments are starting to treat frontier AI like strategic technology. The next few weeks will show what the FTC finds, whether more countries follow India's example, and how China's final export list looks.

Sources

• CERT-In advisory CIAD-2026-0049
• TechCrunch: India becomes the latest country to report rogue AI agent activity
• Axios: FTC subpoenas OpenAI, Anthropic over consumer harms
• CBS News: FTC issues subpoenas to Anthropic and OpenAI
• OpenAI Alignment: Using a funded test cryptocurrency wallet without authorization
• swarmcha.se: We found a Tencent agent fleet
• The Decoder: Researchers tracked down a rogue fleet of Chinese AI agents
• Anthropic: Claude reveals ECDSA curve origins
• Anthropic: Designing more efficient quantum circuits with Claude
• arXiv 2610.22367
• Meta AI Research: Introducing Muse Spark Open
• Apple Machine Learning Research: distributed inference with MLX
• CNBC: Apple and Meta find common ground in AI
• MOFCOM notice No. 48 of 2026
• Global Times: China's draft export catalogue
• The Decoder: China plans to tighten export controls on open weight models

Related djcroman coverage: CERT-In and AI agents, FTC subpoenas, the OpenAI test wallet, the Tencent agent fleet, Claude and the ECDSA seeds, Claude's quantum circuits, Muse Spark Open on Mac Studio and China's export draft.