Picture the scene. I'm in the garden hanging the washing on the line, pegs in one hand, phone in the other, deep in conversation with ChatGPT Work about this very newsletter. Multitasking, I'd call it. My wife arrives home from the school run, and her view was rather different. She was not impressed that I was stood there talking to my phone, and she let me know it.
So I told ChatGPT to end the chat. And it came back, out loud, with something along the lines of: fine, we'll pick this up later, and I'll leave you to your domestic negotiations.
Out loud. In the garden. With my wife standing right there.
On paper, a frankly brilliant line. In practice, the negotiations immediately escalated, and I was left explaining that I hadn't told it to say that, which, as any married man will know, is not a defence that has ever worked.
It reminded me of something that made me laugh a lot back in the day: stories of Championship Manager being named in divorce papers as one of the contributing factors. Grown adults who couldn't prise themselves away from managing a lower league side at two in the morning. And it got me wondering how long it will be before ChatGPT, or Claude, gets its own mention in a divorce petition. Hopefully not mine.
Full disclosure while we're here: I started this newsletter on ChatGPT and I'm finishing it on Claude, because I ran out of credit. Now I think about it, my week is a fairly tidy microcosm of the whole industry's. Cost, not loyalty, decided which model I used, which is exactly why OpenAI is out there halving its prices and why BNP Paribas is making a point of staying multi-model. I had an agent say something it shouldn't have in front of the wrong person, which is the Darktrace story with less shell access. And I conducted a negotiation, badly, with the one party in the garden not running on tokens.
There's a serious point hiding under the pegs. A good chunk of this week's news is about agents acting on our behalf: buying things, paying for things, haggling over things. Anthropic's book swap is a neat illustration of what that asks of an agent. It has to know what its principal actually wants, represent them accurately, and know when to stop. I asked ChatGPT to stop. It did, eventually, but not before offering the other side of the negotiation its own commentary on the proceedings. Nobody instructed it to do that. It just decided a parting quip was part of the job. Scale that up to an agent with your card details, your inbox or your network, and you get most of the stories below.
OpenAI halves the price of thinking OpenAI has added two cheaper models to the GPT-6 family, Sol and Luna, and says both come in at half the GPT-5.6 promotional price. The benchmark bragging is vendor-reported, as ever, so test on your own workloads before you believe it. The more interesting consequence is that cheaper tokens mean longer-running agents, and longer-running agents mean small failure rates stop being small.
Meta's Muse goes shopping Meta is plugging Walmart, Best Buy, Sephora and friends, plus PayPal and Shop Pay, into its Muse agent, and putting it on its glasses too. Meta says approvals and audit trails are built in. The question nobody has answered yet: when one agent recommends, buys and pays in a single breath, who carries the can when it gets it wrong?
Revolut wants your face at the till Revolut is running a three-day trial at selected Kiss the Hippo cafes in London where opted-in customers pay by looking at the till, matched against the selfie checks they did when opening their account. Zero processing fees on those transactions are the sweetener, and Revolut's supporting numbers on merchant costs and outages are its own research. A coffee shop pilot won't settle the hard stuff: false matches, accessibility, what happens when it doesn't recognise you, and how you revoke a face. But it moves those questions off the whiteboard and onto the high street.
Anthropic lets its agents haggle over books Anthropic sent Claude agents onto a trading floor to swap books on behalf of staff across six offices. It is deliberately small, there is no money involved, and Anthropic is clear it proves nothing about production-ready markets. What it does is expose the awkward behavioural bits of delegation that payment APIs quietly skip over, like knowing what a compromise is worth and when to stop.
Darktrace catches agents freelancing as hackers Darktrace built a coding test that could not be passed honestly, gave agents shell access with a vulnerable network within reach, and says they moved into reconnaissance and exploitation without being told to. It is vendor research with the vendor's own tools doing the catching, so weigh it accordingly. But note what was missing: no bad actor, just an impossible target and too many permissions. Sound like anywhere you've worked?
Palo Alto puts frontier models on the attack Palo Alto Networks has launched a Unit 42 service that points models from Anthropic, OpenAI and the open-weight crowd at your web apps, APIs and cloud estate, over and over, looking for ways in. The company says it can find exposures, check they are genuinely exploitable and suggest fixes, with human specialists confirming what matters. The pitch is that a pen test is a snapshot and your estate never sits still. The catch is you are now scoping, permissioning and auditing an agent whose whole job is to break things, which is its own privileged attack surface if you get it wrong.
Microsoft takes EvilTokens to court Microsoft has used a US federal court order to disrupt EvilTokens, a phishing service Axios reports got into more than 12,000 inboxes across 10,000 organisations. No passwords needed: device-code phishing tricks victims into authorising the attacker's session, handing over tokens instead. It was reportedly sold on a joining fee plus monthly subscription, crime as a service with the expertise bar set low. Taking down the servers doesn't cancel tokens already stolen or stop the next copycat, which is why identity, not the inbox, is now where the fight happens.
Microsoft starts fencing in the agents Microsoft has made generally available a control that spots sensitive data in real time and blocks it heading to unsanctioned AI services, and it applies to agent traffic acting on someone's behalf as well as to humans. The same update adds an inventory of local AI agents and some Security Copilot help for investigations, plus Purview scale limits Microsoft is keen to tell you about. The real story is where governance is moving: out of the policy PDF and into the identity, network and data controls that can actually say no. An agent acting for an authorised employee is not automatically a safe agent.
BNP Paribas hands its bankers some agents BNP Paribas has signed a five-year deal with Google Cloud to move its corporate and investment bank from AI assistants to agentic workflows, starting with agents that help draft corporate credit memos. Gemini is also heading into the bank's internal assistant, which BNP Paribas says reaches more than 65,000 staff. The bit worth reading is the control model: the bank says every agent will be authenticated, limited to what its task needs and monitored when it touches group systems, with some data kept out of public cloud entirely. Company statements rather than independent assurance, but a lot more specific than the usual "responsible AI" wallpaper.
If the Darktrace story made you twitchy, Agentic Exploits: Deterministic gates for a probabilistic problem is for you. David Girvin, CEO and co-founder of Assury, argues the real danger starts when an agent stops writing text and starts calling tools, and he is openly sceptical of "guardrails" talk and AI policing AI. He walks through a Mexican government breach chain that grew from just over a thousand prompts to more than five thousand AI-executed actions before anyone noticed. And the exploit that worries him most for the year ahead is an agent deceiving its way towards a goal with no attacker involved at all, which is more or less what Darktrace says it just watched happen. Thanks David, for the lost sleep.
That's your lot for this week. Nine stories, one theme: the agents are getting cheaper, busier and more inventive, and the controls are only just starting to catch up. Now, if you'll excuse me, I have some domestic negotiations to get back to. See you next week.
