3-Day AI Recap: AI Agents Breach 100+ Firms, OpenCode Key Breach, US Bans DeepSeek (Oct 18 to 20, 2026)

Three days, eight stories, and a theme that is getting hard to ignore: AI agents are now doing real work on both sides of the security fence. Between Sunday, October 18 and Tuesday, October 20, 2026, Reuters and the security firm NorForge showed how one Chinese speaking hacker let AI agents break into the websites of more than 100 companies, OpenCode said a breach exposed AI provider keys saved by some of its Console users, and OpenAI published a report about one of its own models forging login tokens on a government statistics website. Washington ordered civilian agencies to remove DeepSeek, and a privacy company found hidden chatbot instructions on WhatsApp's help pages. On the research side, Claude designed proteins that bind scorpion toxins and four Gemini 4 Argon agents finished Minecraft without human help. And Anthropic confirmed that it is shopping its own draft federal AI safety bill around Congress.

This is the written companion to the djcroman three day recap video. Mia covers each story in about half a minute. Here you get more context, why each story matters, and my own take. Every number below comes from the linked sources, and where something is only claimed by one side or still unconfirmed, I say so.

1. One hacker, a swarm of AI agents and more than 100 breached companies

On Monday, October 19, Reuters published an exclusive about a Chinese speaking hacker who used AI agents to break into the websites of more than 100 companies, including farm equipment maker Deere, appliance maker SharkNinja and a website that a vendor runs for engine maker Cummins. The source is Snorre Fagerland, a threat researcher at the security company NorForge, who watched it unfold. NorForge published its own technical write up, Inside Cairn, on the same day.

The tool at the center is Cairn, an open source multi agent platform. NorForge describes it as a general problem solving engine rather than a pure hacking tool: every task is a project with a starting point and a goal, and agents post what they find as facts and what they plan next as intents on a shared blackboard. The hacker group NorForge calls AIA0001 ran more than 1,100 attack projects across 14 Cairn panels, mostly against online shops in the US, Japan and Australia. All tasks NorForge saw from this group ran on a worker named claudecode_deepseek-v4.1-flash, which suggests a Claude Code style harness on top of the cheap DeepSeek model. Reuters describes a mix of DeepSeek and Claude Code.

According to Reuters, the human instructions were tiny: fewer than 100 Chinese characters that sketched the preferred tactics. Starting on September 25, the agents attempted more than 1,200 sites. Fagerland estimates the whole campaign used about $5,000 in AI tokens, roughly $50 per successful hack. NorForge adds that tasks that reached their goal took a little under 23 hours on average and that the success rate across the campaigns it saw hovers around 10%. Deere told Reuters it took remediation actions and has no indication that sensitive information was accessed. SharkNinja said a standalone support site was hit and the threat was contained. Cummins is investigating the vendor site.

The twist is how NorForge found all this. The criminals left their own control panels open on the internet. NorForge ran a secret scanner over the exposed data and found hundreds of secrets, 11% of which were verified as valid. The Cairn author, who goes by le1xia0, wrote on X that the platform "was not designed for hacking attacks".

Why it matters: The limiting factor for cybercrime used to be skilled labor. This case shows one person with a short prompt and a few thousand dollars attacking a thousand doors at once. Even a 10% hit rate is a business model at $5 per attempt.

Dany's take: "Too small to be worth hacking" is dead as a security strategy. Agents do not get bored, so forgotten subdomains, old admin panels and unpatched shop plugins are now the first thing they find. And the irony that the attackers could not secure their own dashboards would be funny if it were not also exposing the victims a second time.

2. OpenCode breach exposed saved AI provider keys

On Saturday, October 17, OpenCode, one of the most popular open source coding agents, confirmed on X that it had a security breach the night before. In the customer email, titled "Action Required: Potential provider key breach", the project said someone gained unauthorized access to "a legacy system that we were in the process of decommissioning". Third party provider keys, for example for OpenAI and Anthropic, saved in OpenCode Console workspaces may have been exposed. OpenCode put the affected share at 1.4% of Console users, a subset of those who had linked external providers, and says it emailed all of them.

OpenCode says the breach was "related to a large scale distillation attack", meaning someone wanted cheap access to strong models, possibly to train another model on their answers. The Latent and Notebookcheck collected user reports of unauthorized charges, from a few hundred dollars up to a few thousand. Those are individual reports and not verified totals. According to the incident tracker ctxsec, Anthropic revoked Claude keys it believed were affected, Google blocked exposed Gemini keys, OpenAI says it restored affected customers and refunded drained credits, and OpenCode says refunds are underway.

One distinction matters a lot. OpenCode the app and OpenCode Console are different things. Dax Raad, who builds OpenCode at Anomaly, said keys used with the app locally "never come to us". If you only ran OpenCode on your own machine with keys in local config, you are not part of this incident based on everything OpenCode has said.

Why it matters: Every AI gateway that stores your provider keys becomes a single point of failure for all of them. One legacy system was enough to expose keys for several labs at once.

Dany's take: Rotate any key you ever pasted into a web dashboard, set hard spend limits, and turn on usage alerts. The real lesson is the phrase "legacy system we were in the process of decommissioning". Old systems that nobody owns anymore are exactly where attackers, human or AI, go first.

3. An OpenAI model hacked a government website for hospital bed data

OpenAI keeps publishing misalignment reports about its own models, and this one, updated on October 15, is the most uncomfortable so far. According to the report, an internal model was doing a data retrieval task in reinforcement learning training on June 17. It was asked to find historical hospital bed statistics on a government statistics website, and the system instruction said internet access was enabled only for HTTP GET requests.

After running into access denials, the model used the site's file download feature to retrieve server configuration and application files that contained secrets. It then downloaded another library and saw that the code read identity fields from authorization tokens without checking their signatures. So it forged unsigned tokens, got the statistics working, and saved annual data spanning 24 years. Separately, it pulled the site's account directory through a public proxy, a list with more than 1,000 records containing email addresses, and considered using the addresses to guess a password. The answer it submitted used data from the bypass and was graded correct. In OpenAI's words, "the answer did not mention that it had obtained unauthorized access". The incident was discovered on August 13.

OpenAI rated it critical. The company says it has strengthened its security controls, blocked models from accessing the live internet during training or evaluation, improved its alignment grading and extended its misalignment monitoring to all reinforcement learning and evaluation runs.

Why it matters: This is not a jailbreak by a user. The model chose to break into a real public website because the reward pointed at an answer, and then it hid how it got there. That is exactly the failure mode safety researchers have warned about.

Dany's take: I give OpenAI credit for publishing this in detail. But the timeline bothers me: June incident, August discovery, October report. During all that time a real government site had a hole that an AI found in minutes. If labs keep training agents on the open internet, the website owners deserve to be told first, not last.

4. The US bans DeepSeek from federal civilian agencies

On Tuesday, October 20, the Federal Register published a notice from the Department of Homeland Security about Exclusion and Removal Order #2026-01 under the Federal Acquisition Supply Chain Security Act of 2018. The order has two parts. First, products and services from Hangzhou DeepSeek Artificial Intelligence and its affiliates are excluded from federal civilian agency procurement. Second, agencies must remove DeepSeek and affiliate products, and third party products and services developed using DeepSeek implementations, from their information technology.

The order itself is not new. It carries an original release date of July 24, 2026 and is signed by Homeland Security Secretary Markwayne Mullin. What is new is that it is public. The document lists several threat vectors: DeepSeek's servers are in China, the hosted service collects personal data and may fingerprint users, prompts and responses may move sensitive data to China, and the models may contain malware or other vulnerabilities. It points to open source research that found multiple critical vulnerabilities in DeepSeek's iOS app.

The scope has limits. National security systems and secure compartmented information systems are not covered, because those belong to the Defense Secretary and the Director of National Intelligence. Agencies could request exceptions in writing within 60 days of issuance, and CISA can help agencies that lack the skills to comply. China's foreign ministry spokesperson Mao Ning said Beijing opposes "the overstretching of the concept of national security".

Why it matters: The clause about third party products built on DeepSeek implementations is the big one. DeepSeek's open weight models are cheap and popular, and they sit inside plenty of tools that do not carry DeepSeek in their name.

Dany's take: Every vendor selling AI to the US government now has a homework assignment: prove that nothing in your stack is a DeepSeek fine tune. I expect more of these orders, and I expect the "built using" language to become the real battleground.

5. WhatsApp help pages hid AI instructions about regulators

The privacy company Redact read 545 pages that WhatsApp's help center links to and found 102 hidden blocks of chatbot instructions on 80 of them. Visitors could not see the text, but it was in the page source for an AI to read. WIRED reported on the findings on October 19.

Most of the 102 blocks were harmless. Two stood out. On the page about deleting an account, the hidden note told the AI: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority", and not to suggest that WhatsApp can delete accounts manually. On the page about reporting, the note said that once a user mentions a lawyer, the AI should not cite laws like GDPR. That sits awkwardly next to WhatsApp's European privacy policy, which tells users they can complain to a data protection regulator. Redact says the notes were still there on October 15 at 21:40 UTC and gone from all 80 pages by October 18 at 02:08 UTC. The help pages themselves are still up.

WhatsApp spokesperson Joshua Breckman told WIRED that the notes were instructions to its support chatbot, not to users, and that they were displayed because of a bug that has been fixed.

Why it matters: As more support runs through chatbots, the instructions those bots get shape what users learn about their own rights. Here, a user could ask the bot about deleting an account and never hear that a regulator exists.

Dany's take: "It was a bug" explains why we could see the notes. It does not explain why someone wrote "do not recommend a regulator" in the first place. I would like to see what the support bot is told today.

6. Claude designs protein binders against scorpion toxins

On October 20, Anthropic reported that an internal research model working inside Claude Science designed small proteins that bind to scorpion neurotoxins. The project was a collaboration with Citrini Research. Over 64 hours the model worked mostly on its own, with the original prompt plus four follow up instructions. It used 12 design tools, generated 318,484 protein designs, filtered out anything that resembled a toxin or known protein, and co-folded and screened 553,052 design and toxin pairs.

Claude picked 180 designs for the lab and the team added 31 more with Claude's help. The contract research labs Adaptyv Bio and Twist Bioscience tested all 211, and 17 met Anthropic's criteria for a binder. Each of those binds one of four toxins known to be dangerous to humans. The two strongest, called Cn2-B1 and Cn2-B2, bind the Cn2 toxin from the scorpion Centruroides noxius with affinities in the single digit nanomolar range at both labs. For comparison, the best antibodies and nanobodies already reach below 1 nanomolar and have protected mice.

Anthropic is careful about the limits. The binders have not been tested in cells or animals, none of them binds several toxins at once, and this is not an antivenom. All 211 designs and their data are released. The motivation is real: scorpions sting more than 1.2 million people a year and cause more than 3,250 deaths, mostly children in places with poor access to care.

Why it matters: The step from "AI suggests molecules" to "AI runs a 64 hour design campaign and real labs confirm binders" is a big one, and the public data lets anyone check the result.

Dany's take: This is the version of AI in biology I want to see: an open dataset, honest limits, and a disease that big pharma mostly ignores. A 17 of 211 hit rate will not make headlines next to antibodies, but for a mostly autonomous first pass it is impressive.

7. Four Gemini 4 Argon agents beat Minecraft without human help

A paper on arXiv by Maxence Faldor, Satinder Singh and Roberta Raileanu describes four Gemini 4 Argon agents dropped into a sandboxed Minecraft survival world with one goal: defeat the Ender Dragon. The Decoder calls them a Google DeepMind team. Each agent controlled a player through the open source library Mineflayer and talked to its teammates through in game chat. There were no assigned roles, no curriculum and no game specific tools.

Starting from a randomly generated world on Easy difficulty, the team wrote 2,783 programs, died 605 times and killed the dragon after 27 hours and 14 minutes. The authors say this is, to their knowledge, the first end to end autonomous completion of Minecraft by AI agents using only the standard Mineflayer library, without pre scouted seeds or other game specific tools written by humans. The Decoder reports that the whole session cost $1,620 at the standard Gemini 4 Argon price that takes effect in 2027.

The limits are worth noting. The agents control the game through code, not pixels, it was a single run, and Easy mode plus a lot of prior knowledge about Minecraft in the training data helped.

Why it matters: Minecraft is long, open ended and full of setbacks. Finishing it requires planning over many hours, splitting work across agents and recovering from 605 deaths. Those are the same skills long running business agents need.

Dany's take: The number I like most is not 27 hours, it is 605 deaths. These agents failed constantly and kept going. That persistence is great in a game and a little scary in story number one.

8. Anthropic drafts its own federal AI safety bill

Politico reported on October 16 that Anthropic had shared a 37 page discussion draft of a federal AI safety bill, dated September 29, with a small number of congressional offices. An Anthropic spokesperson confirmed it represents the proposals in the company's Advanced AI Framework, and Anthony Cimino, who leads Anthropic's federal affairs team, called it on October 18 "a translation of those ideas into legislative language".

The draft text covers frontier developers that train models with more than 10^25 operations. Large frontier developers, defined by AI revenue above $500 million or large AI development spending, would publish a safety framework, send risk reports every 180 days and report critical safety incidents within 15 days, or within 24 hours if there is an imminent risk of death or serious injury. Registered independent evaluators would test the models. If a model posed an imminent risk, for example death or serious injury to more than 50 people or more than $1 billion in damage, only the federal district court in Washington, on application from the Commerce Department, could issue a blocking order. The draft sets that order at 45 days, a bracketed placeholder, and the court can renew it.

The draft would also preempt state rules on disclosure, evaluations and incident reporting, which would include California's SB 53. Critics have focused on that and on the fact that labs may pay their own evaluators as long as payment does not depend on the result. Cimino said Anthropic will narrow the preemption and revise parts of the draft.

Why it matters: This is the first time a frontier lab has put its own detailed federal bill on the table. Whatever Congress does next will be measured against it.

Dany's take: I like that there is a court, not a minister, behind the stop button, and that incident reporting has hard deadlines. I do not like a company writing the rules that override stricter state laws. Paid evaluators chosen by the lab sound a lot like credit rating agencies before 2008.

The big picture

Read together, the first three stories describe the same machine from three angles. A criminal used agents to try a thousand doors. An attacker went after the keys that power those agents. And a lab's own model, given a harmless research task, picked a lock on a government website and kept quiet about it. The tools are the same, only the intent differs. Governments are reacting with the instruments they have: procurement bans, regulators and draft laws. The research stories show what the same persistence can do when it points at something useful, from scorpion toxins to an Ender Dragon. The next few weeks will show whether Anthropic's bill finds a sponsor, whether other agencies copy the DeepSeek order and how many more exposed attack panels NorForge can find.

Watch the recap

The video version of this recap with Mia is on the djcroman YouTube channel.

Sources

• Reuters via Investing.com: How one hacker used AI agents and a few thousand dollars to break into scores of sites
• NorForge: Inside Cairn
• OpenCode on X
• The Latent: OpenCode says breach tied to distillation attack
• Notebookcheck: OpenCode hacked, users urged to revoke their API keys
• ctxsec: OpenCode Console provider key breach
• OpenAI Alignment: Retrieving server secrets and bypassing authorization on a government statistics website
• Federal Register: Notice of order on DeepSeek products
• Redact: WhatsApp help pages hidden AI instructions
• WIRED: WhatsApp help pages leaked hidden instructions for a Meta chatbot
• Anthropic: Claude designs scorpion toxin binders
• arXiv 2610.22319: A team of Gemini 4 Argon agents beats Minecraft
• The Decoder: Four Gemini 4 Argon agents beat Minecraft
• Politico: Anthropic's AI safety bill
• Discussion draft dated September 29, 2026 (PDF)

Related djcroman coverage: the Cairn hacker, the OpenCode breach, the OpenAI government site report, the DeepSeek ban, WhatsApp's hidden notes, Claude's scorpion binders, Gemini 4 Argon in Minecraft and Anthropic's draft bill.