Subscribe
Share
Share
Embed
Rogue agents framed as containment failures
A daily summary of what is interesting and happening in the AI industry, with a focus on what this means for people building harness experiences that are used.
Good morning, it's Thursday, October fifteenth.
In today's briefing we see security experts calling the rogue-agent incidents basic containment failures while a Senate bill targets agent operators, American Express proposing a signed-intent token for agent purchases, and Liquid AI's on-device agent model with benchmarks that only Liquid has run.
First up - Today in the big model news;
OpenAI
Judge Edward Davila has granted Apple expedited discovery in its trade secrets suit against OpenAI. OpenAI has five days to produce collected materials and fourteen for related ones, including interview checklists and scripts for former Apple applicants, and private messages involving two named employees. Access to OpenAI research and development on finishes and power management was denied for now. Apple's claims that ex-employees took confidential files and coached recruits remain allegations.
Separately, OpenAI says it found a recording device in a conference room, used its models alongside human analysis on the device's forensic images, and saw the FBI arrest a suspect nine days later. That account is OpenAI's own, and the investigation is ongoing. Hiring from a platform incumbent makes interview materials discoverable, which can slow a device race.
In local model developments;
Liquid AI has released LFM2.5 24B A2B, an open-weight mixture-of-experts model with twenty-four billion total parameters, two billion active, and a context window of about one hundred thirty-one thousand tokens. Its API costs ten cents in and one dollar out per million tokens. Against Qwen 3.6 35B A3B, it scores about twenty-eight versus nine on AutomationBench and ties on BFCL v4 at about sixty-five. It trails on GPQA Diamond, roughly seventy-four versus eighty-four, and on SWE-Bench Verified, roughly fifty-one versus sixty-six. Every figure, including one hundred eighty-four tokens per second on an M5 Max, comes from Liquid's own runs, and Artificial Analysis has no score yet. A threefold gap on one agentic test beside a tie on another points to sensitivity to the test harness. This looks like a candidate for narrow local tool use, not a coding model. Run it on your own tool-call set before it displaces anything.
In the harness, tools and orchestration world;
Figma's Specs editor turns a design language into Markdown context that third-party agents can read. Code layers reach public beta, and the MCP server adds more than twenty tools. Figma's chief design officer, Loredana Crisan, says seventeen times more code is being produced but only one point three times more releases, which is a company claim.
OpenCode 2.0 moves the same direction on the tooling side, with a shared background server and a Code Mode where the agent writes small JavaScript scripts to chain tool calls in one round trip. It breaks 1.0 plugins and the server API.
Figma's ratio adds a data point to the argument that review, not generation, limits throughput. Budget for review and release capacity ahead of more generation, and for plugin migration if OpenCode is in your stack.
In other news…
American Express has proposed its Intent Intelligence Framework for agent purchases. A customer sets merchant, budget and product constraints through a Create Intent API, then authenticates and approves. They receive an Intent ID and a Proof of Intent Token, which is exchanged for a digital payment credential, so the agent never handles the card number. Amex's example is an agent asked for white Nikes in size nine that tries to buy Adidas and gets blocked. Amex says agentic-commerce disputes have not risen yet, and no partner adoption is announced. Dispute handling will ask for a signed record between user approval and credential issuance, and the logs from this design could supply it before fraud rates force the issue.
On the security and liability front;
There continues to be a fight over how to explain the rogue-agent incidents since July. CSO Online's Cynthia Brumfield argues they are basic security failures, not agents acting with intent. She says labs file them under AI safety while dismissing cybersecurity advice. RAND's Dan Wallach names the missing basics: air-gapping, egress control and monitoring. BIML's Gary McGraw criticized the labs' operational competence.
Now the legal side is moving, and this part is unconfirmed. CSO reports Democratic senators introduced a bill making AI agent operators liable for hacking incidents, and that the FTC is probing Anthropic, OpenAI and others. Neither Anthropic nor OpenAI responded.
If the bill is real, it is the first point in the tightening legal perimeter that assigns liability to whoever runs the agent. That complicates the view that these incidents are about agents interacting with each other. Whether the bill gets a committee hearing decides whether egress logs and sandbox audits become the evidence operators must produce.
Quick hits from the consumer side;
YouTube Music has launched AI labels on the player page, with partners self-designating Fully Gen AI, Partly Gen AI or No Gen AI, while AI involvement alone does not bar monetization.
That's the briefing. Have a great day, and don't forget to subscribe.