Friday, and the thread running through today's headlines is autonomy — AI that doesn't just answer a question but takes an action with consequences. It's showing up inside bank accounts, inside attack campaigns, and inside the capital markets funding all of it. The capability is here. The controls are running to catch up. Here's where that gap showed up today.
The agents are in your bank account now
Start with money that can actually move. Major banks including Morgan Stanley and Bank of America are racing to contain the risk from unvetted third-party AI agents that can access customer accounts, with the core problem being attribution — a bank needs to know whether an action reflects the customer's instructions or an agent operating beyond them. An agent that reads a balance is one risk. An agent that moves one is another entirely.
The operator's take: the moment an agent can act inside a system that moves money, exposes accounts, or touches a customer of record, permission design stops being a UX decision and becomes a financial control. The question your auditors will ask isn't "do you use AI" — it's "when an agent did X, can you prove whose intent that was." If you're wiring agents into billing, procurement, or anything with a dollar sign, build the attribution and the scoped, revocable credentials first. Retrofit is how you end up explaining a transaction nobody authorized.
The same autonomy, pointed the other way
Now flip it. The tools letting your team ship faster are letting attackers do the same at scale. Using exposed panels of Cairn, an open-source AI tool popular with hackers, the autonomous agents tried more than 1,200 sites and reached websites belonging to more than 100 companies — including farm-equipment maker Deere, appliance company SharkNinja, and engine maker Cummins — according to Reuters, which reviewed the attacker's own records. The operation was surfaced by researcher Snorre Fagerland of the security firm NorForge, who found it by scanning the internet for exposed copies of the tool.
The operator's take: assume parity. The same agentic loop that lets one engineer do the work of five lets one attacker probe a thousand targets while they sleep. The economics of being a low-value target just changed — you no longer have to be interesting to get hit, you just have to be reachable and unpatched. That raises the premium on the unglamorous basics: external attack-surface inventory, fast patch cycles, and alerting that assumes the thing scanning you never gets tired.
Capital isn't the constraint — governance is
If you thought export bans and federal bans would starve the frontier, the funding market disagrees. DeepSeek reportedly pulled in roughly $15 billion (about 100 billion yuan) in one of China's largest-ever private AI rounds, with Tencent and CATL among the lead backers — a raise that landed just two days after the U.S. ordered federal agencies to remove DeepSeek technology, and that follows a $7 billion round in June. A government ban on one side, a mega-round on the other, in the same week.
The operator's take: capital is clearly not the bottleneck for capable models — governance, trust, and provenance are. For a buyer, that cuts two ways. Cheap, powerful models will keep arriving regardless of who's banning whom, which is good for your build-vs-buy math and your negotiating leverage. But the geopolitics now ride along with the weights: where a model is trained, who funds it, and whether you can legally run it for your sector is a procurement question, not a footnote. Pick your model vendors like you pick your auditors — assume someone will ask you to defend the choice.
Also on my radar
- AI agents out-diagnose solo doctors. Microsoft's MAI-DxO orchestrator — a panel of AI agents that question patients, order tests, and debate diagnoses — correctly diagnosed 83% of complex New England Journal of Medicine cases versus 36% for primary-care physicians working alone, per a Science paper — more proof the frontier is agents collaborating, not a single model answering, and the architecture worth copying for your own high-stakes workflows.
- Splunk patches two dozen. Splunk released fixes for 24 vulnerabilities across Enterprise and SOAR on October 21, including four critical flaws scored from 9.3 to 9.9 — your SIEM is a crown-jewel target precisely because it sees everything, so this goes near the top of the patch list.
- HPE ships eight max-severity fixes. Hewlett Packard Enterprise patched 72 vulnerabilities in ArubaOS, including eight maximum-severity authentication bypass and code execution issues — the network gear under your floor tiles deserves the same urgency as your apps.
The through-line today is that autonomy has arrived in the rooms where decisions have consequences — moving money, breaching companies, diagnosing patients — while the money funding all of it keeps flowing past every ban and markdown. The operators who stay ahead this quarter aren't the ones with the most agents; they're the ones who can say exactly what each agent is allowed to do, prove whose intent it served, and patch the floor before someone else's agent finds the gap. That's the Signal for today.
Paul Sapio is the CIO of Mikhail Education and a full-stack AI engineer. Open to contract work in security, networking, AI, and SaaS development — reach out.