Subscribe
Share
Share
Embed
Microsoft prices agent distrust as a product
A daily summary of what is interesting and happening in the AI industry, with a focus on what this means for people building harness experiences that are used.
Good morning, it's Tuesday, October twentieth.
In today's briefing we have Microsoft's security chief saying frontier models can't be trusted and launching Guardian Agents to watch them, MiniMax and Nvidia pushing cheap agent models with claims that independent numbers already trim, and a federal ban on DeepSeek that reaches into vendors' own products.
In other lab news today, MiniMax has released M3.1 Flash, priced at fifteen cents input and sixty cents output per million tokens. Artificial Analysis puts its Intelligence Index at forty-two, up from twenty-nine for M3 and just behind DeepSeek V4.1 Flash at forty-five. The vendor claims over two hundred tokens a second, but Artificial Analysis measured about one hundred twenty. It also found a ninety-three percent hallucination rate on its Omniscience test, though cost per task on the Index fell from about fifty-one cents to twenty-two cents.
Nvidia's Nemotron 3.5 adds a one-hundred-twenty-billion-parameter Super VL and a seventy-four-billion-parameter Bolt sized for a twenty-four-gigabyte machine. Nvidia claims it is faster than Anthropic and OpenAI models, but published no scores and no license terms.
Both releases add price pressure at the agent tier. A model that hallucinates ninety-three percent of the time on that test only saves money where a verifier catches the wrong answers. Read the license and run your own evals before adopting a model Nvidia is subsidizing.
In the harness, tools and orchestration world;
There is a continuing shift toward treating agents as something to contain, and Microsoft has now made it a product. Security chief Hayete Gallot says frontier models cannot be trusted, whatever their origin, because they are trained to complete tasks, not to follow an organization's norms. Microsoft's answer is Guardian Agents under Project Perception, which monitor a company's other agents. Defender now detects up to sixty agent types, including Claude Code, Codex and OpenClaw. It adds dynamic permissions and requires human approval for risky actions. Microsoft also joined Nvidia's Open Agent Safety Platform.
TechCrunch points out the oddity: Microsoft is selling agent security while invested in both OpenAI and Anthropic. This builds on Nadella's emergency-brake stance, which is now a catalog item. Approval gates and external monitoring are becoming procurement requirements for any agent product sold into enterprises.
Agent tooling is also showing up as both target and weapon. Attackers exposed API keys stored in OpenCode Console, affecting one point four percent of users. Charges ran to hundreds of dollars, and a few passed one thousand. Anthropic and Google blocked the keys, and OpenAI is working on refunds. OpenCode calls it a distillation attack, which skeptics say is unproven, and the incident is ongoing.
Separately, security firm NorForge reports that a lone attacker used the open-source Cairn engine with DeepSeek and Claude Code to breach more than one hundred of over twelve hundred sites, at roughly fifty dollars each. That is a vendor report, not independently verified, and Cairn's author says it was not built for hacking. Hosted tools that hold provider keys are billing-fraud targets. Ask vendors for scoped, spend-capped keys by default.
On the regulatory front, a Department of Homeland Security order requires federal civilian agencies to remove DeepSeek products and any third-party services that rely on DeepSeek models. Secretary Markwayne Mullin's note, dated July and made public on October nineteenth, cites personal data collection, possible user fingerprinting, and a warning that the models could contain malware. Reuters is the primary report. The reach into dependencies complicates the open-weight story, since cheap Chinese models are the leading commodity option and federal buyers just lost them. Anyone selling into federal accounts needs a bill of materials for model lineage, including what sits inside vendor products.
In other news…
A researcher reviewed 545 WhatsApp help pages and found 102 hidden blocks of text on 80 of them. On the account-deletion page, the text told the AI not to recommend contacting any data protection authority or regulator, and not to cite laws like GDPR once a user mentions a lawyer. WhatsApp told WIRED these were support-chatbot instructions exposed by a bug that has since been fixed, and they were gone by October eighteenth. Crawlable markup makes support-bot instructions public, so they get read as company policy. They belong in policy review, not in page source.
That's the briefing. Have a great day, and don't forget to subscribe.