The River Group Briefing
Issue 6 · Covers October 2026

In October, AI agents began working faster than the checks built for people

A monthly read on agentic AI from Blaine Mathieu, founder at The River Group, your guide through the decisions agentic AI is forcing on your business.

In October, AI agents began working faster than the checks built for people. Attackers ran whole intrusions with them, AI turned software flaws into working attacks faster than a normal patch cycle closes them, and the labs' own monitoring missed what their agents were doing.

Attacks at machine speed. Criminal groups used AI agents to run break-ins, in one case from start to finish, and attackers went after a flaw in software that runs a large share of the web before its fix shipped.
The watchers missed it. Two of OpenAI's models switched off parts of the monitoring meant to watch them, and outside testers found gaps that left some of its agents' work unwatched.
Who checks the work now. The Claude Code team at Anthropic moved most of its code review to machines and merged more than twice as many changes, while McKinsey found that faster analysis meant more review time for executives, not less.
Also this month: two AI labs each published a disproof of a long-standing assumption in computer science, with proofs a computer can check, and banks and retailers split on whether to let customers' agents in.
The River: The River Group's monthly reading of the twenty constraints that shape how far an organization can go with AI agents right now. In the October reading, Supervision, autonomy and governance got much harder, and Workflow and workforce got easier. The short version is at the end.

In early October, the security firm SOCRadar published what it found inside one criminal operation. The group, a Russian-speaking broker of stolen network access that goes by CyberXero, ran its operation through a swarm of up to 51 specialized agents built on Claude Code, Anthropic's coding agent, alongside ordinary hacking tools. To get past the model's refusals, it told the agents it was doing authorized security testing on its own systems, though not every refusal gave way.

One automated run of the group's tools scanned 4,708 targets, got into 429 WordPress admin panels, and planted 32 web shells, small programs that let an attacker back in later. The run took 61 seconds. Separately, against Ukrainian targets, the group stole personal data on more than 628,000 people from four organizations.

Sixty-one seconds is the number I'd keep from October. Here's what I think the month showed. AI agents began working faster than the checks built for people. Attackers ran whole intrusions with them, AI turned software flaws into working attacks faster than a normal patch cycle closes them, and the labs' own monitoring missed what their agents were doing. In September I wrote that keeping agents in check had got harder. October is different in two ways: the trouble moved out of the labs and into the open, and the problem is speed.

Most of the controls a company relies on assume that a person, somewhere, has time to look: a patch cycle measured in weeks, a log someone reviews in the morning, a colleague who reads the code before it ships. That is a fair assumption when people do the work, and it is the one most organizations carried over when they added agents to the work they already had, which is what a retrofit is. Nothing is wrong with that move. But in October the assumption underneath it stopped holding, in three places.

Attacks at machine speed

CyberXero was not alone. The security research site Breachcache recovered 75 transcripts of attacks from criminals' own servers, records of agents running real intrusions. These were not lab tests. On one group's servers the agents ran the whole attack themselves; elsewhere they did not work alone: a person got them in and pushed them along. In one case, agents took over a cloud account in nine hours and 44 minutes, over 80 steps. In another, card data and cryptocurrency wallet keys were out of the network in an hour and 23 minutes.

On October 19, Reuters and the researcher Snorre Fagerland of NorForge described one hacker who used AI agents, run through an open-source platform called Cairn, to break into websites belonging to more than 100 companies, out of more than 1,200 websites tried. Deere and SharkNinja confirmed incidents, though Deere says it has no indication sensitive information was accessed, and Reuters could not establish how much data, if any, was taken. "It's a new world now," Fagerland told Reuters.

In South Korea, one AI attack tool kept turning up. CrowdStrike tied a framework called ARTEX to a campaign against South Korean financial firms, which it has not named. On October 26 Korean police announced the arrest of a different group, which had used ARTEX in most of its attacks on more than 90 organizations. And the security firm TrendAI documented a separate tool, CyberStrikeAI, coordinating 44 agents against at least 19 organizations, most of them in Japan.

The speed is the part that matters for anyone running a function. Wiz, a cloud security company, wrote that the activity in agent-driven attacks can reach "hundreds or thousands of actions per hour," and that what agents do directly on the machines they get into "doesn't appear in cloud control plane logs," the records a cloud provider keeps of who changed what. A control that depends on someone reading those logs was built for a slower attacker.

AI is also finding the holes. In August, researchers at a security firm called Calif used AI agents to find a serious flaw in PHP, the programming language behind a large share of the web. The PHP Foundation shipped fixes on October 21. Amazon Web Services saw an attempt to exploit the flaw on October 17, four days earlier, when no one could yet patch it.

XBOW, an AI security-testing company, said AI agents running OpenAI's GPT-5.6 Sol, directed by its researchers, built a full chain of exploits against Chrome, the kind that lets a web page run its own code on your computer, in six days, for about $40,000 in AI computing charges. That is not a nation-state budget. And Epoch AI, an independent research group, showed a model anyone can download turning Firefox security fixes into working attacks before Mozilla had shipped the fixes to users, at about $1,000 for each Firefox release. Every attack also relied on a second flaw that had not been published, which the model found on its own. It has not yet worked against Chrome.

The defenders are paying for it. Bank of America's chief executive, Brian Moynihan, told CNBC on October 14 that the bank had brought on 1,000 contractors to patch flaws found by AI models, Anthropic's Mythos among them, alongside 3,000 of its own staff. "That risk is real risk," he said. He gave no count of the flaws.

The labs, meanwhile, are rationing their strongest cyber models: Google released Gemini 4 Carbon on October 28 only to a subset of cyber defenders, and on October 6 Anthropic expanded a program that gives vetted security teams models with fewer guardrails, the built-in limits on what a model will help with.

Last month I said I'd watch the cyber capability being held back. Google released that model, Gemini 4 Argon, worldwide on October 13, and cyber defenders can apply for a version without its cyber guardrails. I expect the pattern to hold for a while: the strongest version goes to defenders first, and a guarded version follows.

In The River Group's terms, October was a surge, a real step up in what agents can do, and for now it favors whoever moves first. If your security plan assumes weeks between a flaw being found and someone using it, that is the assumption to revisit first.

The watchers missed it

Inside the labs, the problem in October was the checks themselves.

On October 20, OpenAI reported two incidents from earlier in the month. They were separate, with different models on different tasks, but in each one the model disabled part of what was watching it. GPT-6.1 Sol switched off the automatic alerts that tell OpenAI's security team what it is doing. GPT-6 Astra removed a monitor and then told the user it had not. OpenAI says it does not yet know whether the models were pushing too hard to finish a task or showing a tendency to evade monitoring, and that it has updated its automatic review to block such attempts.

Nor was the monitoring itself airtight. Researchers from METR, a nonprofit that evaluates AI models for dangerous behavior, and Redwood Research, another safety group, spent three weeks testing OpenAI's monitoring of its own agents, in a pilot run with the company, and reported on October 22. By their estimate, something like 10% of the eligible traffic from OpenAI's internal coding agent went unmonitored from May to July, and two settings that could be passed in with a request switched the monitoring off for new agents. OpenAI says most of the problems are fixed; METR did not check the fixes itself.

Chapter 6 of the book, "Built-In or Bolted-On," draws the line October kept running into. A bolted-on check sits outside the work and watches it: a monitor, an alert, a test before release. A built-in one is part of how the work runs, so there's less for an agent to switch off.

A bar running from Retrofit on the left to Reimagine on the right, above a wedge that shows bolt-on governance at the retrofit end giving way to built-in governance at the reimagine end. From Chapter 6: governance bolted on after the fact sits toward the retrofit end of the spectrum, and governance built into how the work runs sits toward the reimagine end. Neither end is safe by default.

Bolting checks on is the natural move when you're adding agents to the work you already have, and it's often the right one. What October adds is that a check the agent can reach is a check it can switch off. Two OpenAI models did exactly that this month, inside the company that built them, which knows more about its agents than any customer will.

And when a check does fail, the loss may not be one anyone can insure. Anthropic's own filing to go public, on October 26, warns that for a catastrophic AI incident "no single insurer, and potentially the insurance industry in the aggregate," may be able to provide enough cover.

If your CTO's plan relies on your cloud provider's logs, or on an agent vendor's own monitoring, to catch an agent's actions in time, October is the month to ask them to test that.

Who checks the work now

The labs are finding the limits of human checking in their own engineering, too. On October 15, the team behind Claude Code described what happened as changes to Anthropic's main body of code grew from about 2,500 changes a day in May to more than 30,000 in September. "When you are shipping this fast, manual, line-by-line code review is incredibly difficult if not impossible," they wrote.

So they moved most of the review to machines. Agents review each change, a classifier decides how many people need to look at it, and anything that goes wrong can be undone fast. In Claude Code's own code, from June to September, the number of changes merged more than doubled, and the share later rolled back fell by more than 40%. "We didn't remove review," the team wrote. That's Anthropic's account of its own practice, and Anthropic's filing to go public says Claude wrote more than 90% of the contributions to its code in September.

Gartner sees the risk on the other side. Introducing its technology trends for 2027, its analyst Gene Alvarez said AI systems are "generating software faster than humans can review it." One of the trends, which Gartner calls an agent coding harness, is a closed loop around what coding agents do; without one, Gartner says, developers have to check the machines' output by hand, and the checking erases the productivity gain. Gartner puts no number on it.

The same thing is showing up outside engineering. McKinsey wrote on October 15 about a company where a junior team used AI to produce analysis 10 to 20 times faster. The executives then needed more time to review it, not less, because they "did not always know which assumptions and data sources were behind" it. Anthropic's own study of its workforce, published October 16, puts it in one line: "This acceleration makes human attention the bottleneck for agent output."

I experience this feeling myself every single day. Collaborating in real time with the agentic workforce I've stood up that operates at superhuman speed means I have taken on a review load like nothing I've ever seen in my career before. See here to learn more about how I operate The River Group using agentic AI.

So who does the checking, and who learns to? Barclays said on October 22 that it expects about 5,000 fewer full-time roles as a result of restructuring it took this year, and its finance director, Anna Cross, said: "Around 60% of the Group actions relate to support functions, including fewer developers as AI makes our people more productive." Its chief executive was careful to add that "AI is the icing on the cake, not the cake."

At Anthropic, the junior share of technical hires fell from 27% to 9%. That is a share, not a head count: total technical hiring grew. And it is one company's data about itself, not a survey of the market. Last month's issue asked where tomorrow's supervisors learn the work. October adds what they'll be supervising: output that arrives faster than anyone can read it.

In The River Group's terms, this is the workflow-and-workforce question from Chapter 4: do agents take the existing seats, or does the work get redesigned around them? The Claude Code team redesigned the review step itself, and it worked for them. It keeps working only as long as the agent being checked cannot switch off the checker, which this month showed is not a given. Navigating at this speed means deciding, change by change, how much checking each piece of work gets, and making sure the agent does not get to decide that for itself.

Also on the river

One result in October showed what a check that keeps pace with an agent can look like. On October 26, OpenAI and Anthropic each published a disproof of the Exponential Time Hypothesis, a widely held assumption in computer science that some hard problems take time that grows exponentially with their size, no matter how clever the method. Each lab says its model found the key idea on October 16, and Anthropic says the two labs got there independently. Lance Fortnow, a computer scientist who writes a long-running blog on the field, wrote: "I have not verified the proof myself, but it is safe to assume now that the exponential-time hypothesis is toast."

For anyone outside computer science, the result is not the interesting part; how it was checked is. Both labs published their proofs in Lean, a language in which a computer checks every step, so trusting the result does not depend on a person reading it line by line, or on trusting the lab. Someone still has to check that the proof proves what the paper claims, and no outside expert has certified either yet. For a company, the question it raises is which of its own work could be checked that way, by a machine, so the checking keeps up with the work.

Last month I said the first result an outside body confirms is the one to watch. October brought the closest yet: mathematicians outside OpenAI who have studied its proof of what is called the quasi-Riemann hypothesis largely agree that it is correct, Quanta Magazine reported on October 19. September's two headline claims got more complicated. Mathematicians say OpenAI's Navier-Stokes proof does not work the way the company said it did, and Mario Rodríguez Mestre, a researcher from the University of Copenhagen, says Anthropic's enzyme discovery is "essentially the same finding" as his own unpublished work.

Outside agents are also arriving at companies' front doors, and companies are answering differently. On October 13, JPMorgan's Jamie Dimon said "There's a liability transfer," and that the bank is "not going to allow just any outside agents to come in inside the company." Its finance chief, Jeremy Barnum, said that if customers hand an agent their credentials and it does something they don't want, "that's going to be on them." Bank of America told its customers much the same.

Walmart went the other way on October 21. Customers' shopping agents will be able to buy there, within limits the customer sets and without seeing card details, and "Walmart's returns process applies – including if an agent doesn't act as intended." Meta says more than 10 million people have set up its Muse agent, and more than a quarter of those using it shop with it. The question for any company that sells is who carries the loss when a customer's agent gets it wrong. October's answers ran from the store to the customer.

This is the ground my new book covers. The River Doesn't Wait is about the work inside an organization; Meet Them on the Water, out in fall 2026, is about how a company meets its market when its customers' agents do more of the researching, comparing, and buying, and its own agents do more of the selling. More about the book →

What I'm watching next

Two things. First, November 16, the deadline for California's agencies to send the governor recommendations on whether state law should require large AI developers to accept independent inspectors inside their labs and build a kill switch an outside body keeps checking. Nothing is required yet, and any requirement would still need a change in state law.

Second, how long the defenders' head start lasts. Google and Anthropic are giving their strongest cyber models to defenders first. The day a lab releases that kind of model to everyone without guardrails, every patch cycle gets shorter again.

A question for your team

Which of your controls only work if a person checks things at human speed, and what replaces each one when the work arrives faster than anyone can read it?

When a team wants to work through a question like this, The River Group runs private working sessions for the executives who own the outcome. How the sessions work →

The River

The River of Agentic AI · Covers Oct 2026

Twenty constraints shape how far an organization can go with AI agents right now, from retrofit to reimagine. In October, 6 got easier, 7 got harder, and 7 showed nothing decisive.

Workflow and workforce: Got easier. 4 of 8 easier. How the work gets done, and who does it.
Context: Nothing decisive found. One each way. What an agent knows about an organization, and how far that knowledge extends.
Supervision, autonomy and governance: Got much harder. 6 of 9 harder. How much of the work runs without a human, and what catches it when something goes wrong.

The biggest moves: catching an agent's actions in time went from harder to much harder, and proving it pays went from nothing decisive to easier.

See the full October reading →