SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: axios.com/2026/10/22/ai-agen…

The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

fun panel yesterday to kick off @AISecSummit in SF, an unfiltered look at what's happening hacking is democratized, and only way for defenders to keep up is with more compute but so much has to be built to make it work some things at inception i'm thinking about - the physical frontier - who's securing the data centers and neoclouds, and the next headache will be billions of new intelligent devices coming online 👀 thanks @dee_bosa for moderating with @mnair1 @snyksec @JohnHultquist + Michael D'Angelo @OpenAI

Engineering leaders told Grepr founder and CEO Jad Naous they spend 5 to 20% of their infrastructure budget on observability, and it's buying less and less reliability. Jad, a former a16z partner, joins a16z's Martin Casado to discuss whether AI can run production systems as well as it writes code. Grepr sits in a company's log stream, can scan a petabyte of logs a day, cuts observability costs by about 90%, and is building AI agents that use those signals to troubleshoot production issues. How AI is changing engineering at Jad's 10-person company: - A data lake feature that once took one engineer about six months took Jad 10 days - The gap between okay and great engineers on his team "just multiplied 10X" - He runs 3-4 agent sessions at once, with a "tech lead" agent reviewing every PR Why running live systems is a harder problem for AI: - Jad: AI can almost tune databases, but can't yet keep servers running on its own - Martin: every bit of code doubles the ways a program can behave, which is why humans still own systems - The real world is messier than AI's training data, self-driving took 20 years and $170B 0:55 From Stanford to a16z to Grepr 7:00 Why observability spend stopped paying off 11:00 From autocomplete to AI that trains engineers 13:10 Why AI widens the engineer skill gap 14:55 Syntax vs semantics 18:00 Inside Jad's AI workflow 22:55 Six months of work in 10 days 24:50 Can AI reason about how systems really run? 30:10 Why AI SRE tools start in the wrong place 32:30 Can AI run a distributed cluster yet? 37:35 Why engineers buy extra capacity over predicting 39:15 How AI could trace failures in production 43:45 Why AI for ops is harder than for code 49:55 Can AI do a VC's job? 52:05 Why self-driving took 20 years and $170B 57:05 Customers skipped the AI pitch for the 90% savings YouTube: youtu.be/blkIGLlZePg @jadtnaous @grepr_ai @martin_casado

fun panel yesterday to kick off @AISecSummit in SF, an unfiltered look at what's happening hacking is democratized, and only way for defenders to keep up is with more compute but so much has to be built to make it work some things at inception i'm thinking about - the physical frontier - who's securing the data centers and neoclouds, and the next headache will be billions of new intelligent devices coming online 👀 thanks @dee_bosa for moderating with @mnair1 @snyksec @JohnHultquist + Michael D'Angelo @OpenAI

We've spent a lot of time at @KeycardAI thinking about how authentication and authorization need to evolve as agents take on more work. API keys and OAuth scopes were never designed to account for tasks, delegation between agents, or agents acting on their own. I wrote about how we're approaching this and what we think needs to change. keycard.ai/blog/defining-aut…

Today we're publishing the first draft of the Agent Baseline Software Factory Reference Architecture! An opinionated blueprint for securing increasingly autonomous software factories, built with folks across the community. It's open for feedback and contributions! agentbaseline.org/reference-…