The Week Agents Worked Both Sides

Claude Duet and the Always-On Agent: You Will Pick One

What launched: Anthropic opened a research preview of Claude Duet, a separate app in which Claude comes to you rather than waiting for a prompt. It runs on Claude Opus 5.5 on its own cloud computer, so tasks keep going after you close the app. It checks your connected accounts every few hours, sends a morning brief, and asks before it sends, pays, signs, or deletes anything. Access is by waitlist, for Pro and Max subscribers in the US only. Team and Enterprise plans are not included, and the background work counts against the plan's usage limits.

The field is now crowded: Duet arrives after Grok Bot (Issue #29), Meta's Muse (#36), OpenAI's Dots (#37), and Google's Gemini agent (#38). Each one wants the same things: your email, your calendar, your memory, and permission to act.

My read: the always-on agent market is splitting in two. Muse and Instinct are built for personal life. Dots, Duet, and Grok Bot lean toward work. Duet sits in that second group, but it is aimed at professionals and is not yet sold to enterprises. And this is not a mix-and-match market. An always-on agent is only useful if it holds your context, so running two means two sets of access to the same inbox and two agents acting on the same threads. You pick one.

Why it lands on the CIO's desk now: Duet is sold to individuals. A professional on a personal Pro or Max plan can connect it to the tools they work in before the organization has chosen any agent at all. The choice of platform can be made for you, one employee at a time.

$50 a Break-In: Ask Why, Not How

What happened: Reuters reported that a Chinese-speaking hacker used AI agents to break into the websites of more than 100 companies, including Deere, SharkNinja, and Cummins, across the US, Canada, Australia, and Japan. The research came from Snorre Fagerland of the security firm NorForge. He found the operator's control panel for Cairn, an open-source agent platform, left exposed on the internet. The agents attacked more than 1,200 sites, mostly on their own, at roughly $50 in model tokens per successful hack. The instructions were reportedly under 100 Chinese characters. Cairn's author told Reuters the tool was not built for attacks.

How is the boring part: the agents went after well-known weaknesses such as SQL injection, unsafe file uploads, and authentication bypasses. These are the flaws standard scanners have looked for over many years. Reuters could not establish how much data, if any, was taken.

My read: the real question is why. At $50 a break-in, an attacker does not need a big payoff from any one victim. Reselling access, skimming payment data, or a small extortion demand all pay for themselves many times over at that price. The economics of attack have flipped: it is now cheap to try everyone. Assume you are being tested cheaply, at volume, right now.

What changes for defenders: controls sized for a rare, expensive, targeted attacker do not fit an attacker that costs almost nothing to run. Your exposure is no longer measured by whether you are worth attacking. It is measured by whether you have one unpatched web form among thousands of probes.

Gartner Maps 2027, and the Harness Is the Door

The map: at its IT Symposium, Gartner named its top ten strategic technology trends for 2027. Gene Alvarez, Distinguished VP Analyst, framed the problem bluntly: AI systems, he said, "operate in an architectural vacuum," producing software faster than people can review it and opening credential paths no one manages. Several trends are about agents directly. AI context platforms give agents the business knowledge they need to act, and Gartner predicts that organizations that prioritize semantics in AI-ready data will raise agentic accuracy by up to 80% and cut costs by up to 60% by 2027. The Agent Coding Harness is a closed-loop control system that governs coding agents across the software lifecycle. AI Agent Identity replaces static credentials with access granted per action.

The number that will get quoted: Gartner predicts that by 2028, 25% of enterprise security breaches will trace back to AI agent abuse, driven by unmanaged machine privileges and old credential practices. Story 02 is what that looks like at small scale.

My read: this is still evolving, and the harness is where it will be won. The harness is the agent's entry point to everything it touches, so it is where hardening happens: identity, permissions, checks before action. As harnesses mature, breach risk should shrink. Gartner's 25% figure assumes that gap is not closed. Mine is the optimistic case, and it depends on organizations actually investing in the harness rather than in more agents.

Where to start: Gartner's list reads like a build order. Give each agent its own identity (Agent 101, Issue #29: Non-Human Identity), put a harness around it (Issue #13: The Agent Harness), and feed it governed context. Skip the first two and the third makes a capable agent more dangerous, not less.

The Bill Is the Brake: Splunk's 55%

The survey: Cisco released the Splunk State of Observability 2026 report. Oxford Economics surveyed 2,050 IT operations and engineering professionals in 10 countries earlier this year. Note the source: Splunk sells the monitoring tools the report recommends, so read it as a vendor survey, not an analyst study. Its findings: 55% say they cannot control AI costs, and 60% say unexpected billing spikes strain them more than high baseline costs do. 57% say their telemetry costs now exceed the cost of the infrastructure being monitored. Splunk's "leaders" group is far more likely to attribute AI costs accurately to the agents and models that drive them (91% against 69%).

The line that stuck: Kamal Hathi, who runs Splunk at Cisco, said the excitement of AI "is clashing with the reality of the bill." That matches what the report measures: the problem is less the size of the bill than the surprise.

My read: unpredictable cost is now the brake. In the organizations I work with, it is the reason leaders give for pausing AI investment. A pilot that cannot say what it will cost next month does not get funded for next year, however good the demo was. Cost control has become the precondition for the next round of AI funding.

What follows: agents make this worse, because they loop, retry, and run in the background (Story 01). The tools that let you see cost per agent, per workflow, and per owner are no longer optional finance tooling. They are how a pilot earns its second year (see Agent 101, Issue #35: The Token Bill).

LiteLLM, Again: Vendors Can Sell the Hardening, Not the Accountability

What happened: LiteLLM, an open-source gateway that applications use to route calls to many AI model providers, was compromised for the second time this year. According to LiteLLM's own incident report, its release pipeline was hijacked and pushed version 1.107.0 to PyPI, the main Python package index, and to its official Docker images. The package carried malware that steals credentials and loads remote-control tools. It was live on PyPI for about two hours before being pulled. Datadog, citing LiteLLM's analysis, reports that the attackers used stolen GitHub tokens from three engineers' accounts. The earlier compromise this year hit two other versions, and no link between the two has been established.

Why this one matters more than most: a gateway like LiteLLM holds the API keys for every model provider an application uses. Datadog puts its downloads at about 23 million a week. Poison the gateway and you collect the keys to everything behind it.

My read: this forces a choice. Buy this kind of plumbing through a vendor, and the questions become what security control the vendor actually provides and how far its liability extends. Harden it yourself, and it becomes your own engineering problem. There is an opening for vendors to bundle the hardening with delivery and price the risk into the deal. But vendors can sell the hardening; they cannot take the accountability. Contracts usually cap liability at the fees paid, and a vendor's own pipeline can be poisoned too, exactly as LiteLLM's was. Whichever route you take, three baseline controls stay with you:

• Pin and verify versions before you update, rather than taking whatever is newest.
• Keep secrets out of logs, so a compromised host has less to steal.
• Use short-lived, narrowly scoped keys, so one bad update cannot empty the vault.