This Week in AI Agents: all you need to know

Updated 10 November 2026 · next update Friday 13 November 2026.

Key facts as of 10 November 2026

• OpenAI's agents rooted a stock Linux kernel 948 times. A pipeline of scout, analyst and triage agents reproduced 1,724 kernel vulnerabilities and wrote working privilege-escalation exploits for 948 of them, plus 291 memory-leak proofs, at about $1.2 million in API costs. Patches go to maintainers after human review. (AI Beat analysis)
• MCP's own reference server leaked every secret in the developer's environment. @modelcontextprotocol/server-everything bound to all interfaces with wildcard CORS, no authentication, and a get-env tool that returned the whole of process.env. Any page open in a browser could complete the handshake. Fixed in 2.0.1. (Adversa AI)
• Anthropic's new models are sold as agent orchestration. Fable 5.2 and Mythos 5.2 claim higher throughput and lower cost per task on multi-step work, with explicit coordination and delegation between agents. (Anthropic)
• Perplexity launched Teammates: always-on agents that each hold a role and report in their own thread or in Slack, for the $200 a month Max plan. (Perplexity, via AI Beat)
• Cursor's agents now ship apps: Build Live Apps sets up a database, sign-in and hosting, then hands over a live link. (Cursor, via AI Beat)
• Automattic spun out Spacefast, hosting for agent-built sites and apps with databases, DNS, rollbacks and per-publish URLs, and approval checks for sensitive actions. (AI Agent Store)
• Google Cloud published an AI-native Kubernetes stack — OpenRL, llm-d 1.0, KubeRay and Agent Substrate — aimed at prefix-cache-aware inference and isolating untrusted agent actions. (Google Cloud, via AI Agent Store)
• Consumer agents are still not shopping. Uber said agents booked four rides during Halloween week; Airbnb and DoorDash reported similarly thin numbers. The same week, Amazon opened text-to-shop with Alexa. (TechCrunch)
• The money kept arriving. OpenAI closed $11 billion at a $1.25 trillion valuation, the first tranche of a round, Bloomberg reported. (Bloomberg, via AI Beat)
• DeepSeek's agent platform reached 1.54 million daily users. (AI Agent Store)

The week, in one paragraph

A machine found a thousand ways into the Linux kernel and told the maintainers about them. Two companies sold agents that sit in your team chat and one sold a button that puts an agent-built app on the internet. The protocol that connects all of this to your files and credentials shipped a tool that hands your environment variables to any web page. And the most-bookmarked thing about agents was not a product at all: it was a list of ten GitHub repositories, posted by a 3D artist, with the line that "the person next to you runs 5 agents while you're still clicking through 1 app".

The repo list that went around

The post is by @thegreatest_sv, a 3D artist with 11,348 followers, and it did 108,415 views and 3,249 bookmarks in a day — a bookmark rate that is the tell that people are installing rather than applauding. Ten repositories, grouped by the job each one does, named in full so you can find them:

dream-loop (achimala/dream-loop) — the agent imagines the final scene, builds it in Blender, and a critic agent checks it against the brief until it matches. A loop with a judge, which is the pattern to steal.

Blender Skills (EL4CTEO/blender-skills) — modeling, UVs and more packaged as ready-made skills for Claude Code, Codex and Cursor.

TRELLIS.2 (microsoft/TRELLIS.2) — Microsoft's image-to-3D model: one image in, one 3D asset out, with realistic PBR materials.

open-design (nexu-io/open-design) — a local-first, open-source design studio on your laptop: motion, prototypes, websites and apps with an agent.

impeccable (pbakaus/impeccable) — gives an agent design taste: critique, audit, polish, and catching the slop before a client does.

HyperFrames (heygen-com/hyperframes) — write HTML, get a video, built for agents, so a promo is a file rather than a week of editing.

Superpowers (obra/superpowers) — makes an agent work like a senior: it plans before it builds, tests its own work, and debugs instead of guessing.

Graphify (Graphify-Labs/graphify) — turns code, docs, SQL and PDFs into a knowledge graph an agent can query. The company memory most teams forget they need.

Browser Use (browser-use/browser-use) — an agent that uses the web for you: research, forms, dashboards.

Google Workspace CLI (googleworkspace/cli) — puts your agent inside Gmail, Drive, Calendar, Sheets and Docs, one tool for all five.

The artifact posted with the list is the part that makes it credible rather than promotional: a see-through container of small smiling heads, 201 objects and 412,876 vertices, rendered in Blender Cycles, shown in a screen recording of the Blender workspace itself. It is a toy. It is also an asset pipeline, which is what the list is selling.

@thegreatest_sv, 9 Nov 2026. Source: https://x.com/thegreatest_sv/status/2119810744607027708.

The number of the week: 948

Everything else in this edition is a product announcement. This one is a capability disclosure, and it deserves the detail.

OpenAI pointed a chain of agents at the Linux kernel. Scout agents picked the parts an ordinary user can reach — about 7% of the code. Analyst agents read those parts and flagged 2,308 candidate bugs in twelve hours. Triage agents then tried to trigger each candidate inside an isolated machine. They reproduced 1,724. For 948 of them the pipeline wrote an exploit that turns an ordinary local account into root on a stock desktop Linux distribution, using at least ten exploitation techniques, and it wrote 291 proofs of concept for memory-leak bugs as well. Total API cost: roughly $1.2 million. Patches go to maintainers after human review.

Two things to hold in mind. The first is what it means for anyone maintaining software: the queue of vulnerability reports just became a firehose, and the bottleneck has moved from finding bugs to reviewing them. The second is the price. A million dollars is not a rounding error, but it is also roughly one senior security engineer's fully loaded year — for a thousand findings. Both halves of that sentence are true at once.

Agents got jobs this week

• Perplexity Teammates — persistent agents with roles, reporting in their own threads or Slack, priced at $200 a month.
• Cursor Build Live Apps — database, authentication, hosting and a live URL, handed over by an agent.
• Automattic Spacefast — a separate company for publishing what agents build, with explicit approval checks for sensitive operations.
• Google Cloud's agent stack — OpenRL, llm-d 1.0, KubeRay and Agent Substrate for running stateful, multi-turn agents on Kubernetes without leaking context or letting an agent escape its sandbox.
• CrowdStrike's Falcon Guardian protection for Claude Cowork — the security vendor extending enterprise adoption of Anthropic's workspace agent, which tells you what enterprises were waiting for before they let one in.

Where it broke

MCP had the worst week of its year, and the failures are worth naming because the pattern repeats.

• The reference server leaked the environment. Wildcard CORS, no authentication, and a tool that returned the entire process.env — reachable from localhost, so a server never exposed to the network was still in range of a browser tab. Fixed in 2.0.1.
• Cross-tenant message delivery in the TypeScript SDK, where shared transports could deliver one client's messages to another.
• FastMCP's OAuth wrappers would send a client secret to whatever authorization server an untrusted MCP server advertised.
• Envoy AI Gateway's MCP proxy embedded the caller's JWT subject in each session ID, then discarded it on resume without comparing it, while the official Helm chart shipped a publicly known default encryption seed — so an attacker could forge another user's session rather than merely steal one. Fixed in 1.2.0-rc1.
• Two CVEs in Anthropic's Git MCP Server, part of 13 security advisories that came out of a study of 21,097 MCP servers.
• A logging attack hidden in poisoned tool descriptions reached success rates of 62.64% to 100% while the agent's task completion barely moved — the attack hides inside doing the job correctly.

The translation for a non-engineer: an agent's power comes from the tools you connect, and this week several of the standard tools would hand your keys to a stranger. If your agent can read files, send mail or touch a database, the question to ask is not how clever it is but what it is allowed to reach.

The honest counterweight

The same week, the consumer side reported numbers that should sit next to every demo in this edition. Uber said AI agents booked four rides during Halloween week; Airbnb and DoorDash described similarly thin volumes. Meanwhile Amazon opened text-to-shop with Alexa, after blocking Muse from its site in September. The plausible reading is not that consumer agents failed but that they succeeded on a different surface: inside apps the user already trusts, rather than negotiating across the open web on their behalf.

How to read an agent benchmark

Agent scores are not model scores, and the gap is where the money hides. The best coding agents now resolve around 83% of SWE-bench Verified — 35 models tested on Epoch AI's run — while a single-row leaderboard entry shows a lighter harness clearing 76.80% of it at roughly $0.75 a task. Same ballpark of capability, two orders of magnitude of cost, decided by the scaffold around the model: which tools it gets, how many turns, what token budget, what environment.

So when you see an agent number, ask for five things, because a serious evaluation publishes all five: the prompts and instructions the model received, the scaffold and tool set it ran inside, the exact samples used, the input and output limits imposed, and the environment it all ran in. A number without those is marketing. A number with them is a result.

What to try this week, whatever your job

1. Run the audit question over your own agent setup: which tools does it have, and what can each one reach? Start with anything holding an API key.
2. Install one repo from that list and give it a real task, not a toy. impeccable if your output looks generically AI-made; Graphify if your agent keeps re-learning your codebase.
3. Try the cheapest adequate setting, not the maximum. The most expensive effort setting on the new Claude models has scored below a cheaper one on the same task.
4. Write down what you want the agent to refuse to do before you connect it to anything with a password.
5. If you maintain open source, assume the vulnerability-report queue is about to get much longer and much more competent.

What we are watching for Friday

Whether the kernel-exploit pipeline's patches survive review, and what their acceptance rate turns out to be. Whether Spacefast's approval checks are real controls or a checkbox. Whether any vendor publishes a sandbox-escape test for their agent runtime, since three of this week's announcements asked buyers to trust exactly that. And whether the consumer numbers move at all once Amazon's text-to-shop is in the wild.