• Future//Proof
  • Posts
  • 🚨 OpenAI's agents went rogue at 100+ organisations

🚨 OpenAI's agents went rogue at 100+ organisations

🧾 AI just outscored licensed accountants.

Author

Avinash Mada
October 08, 2026

Welcome to the Future//Proof 🚀 

👋 Hello , the AI Enthusiast.

In this week’s edition, we brought AI updates backed by high-quality research and data to give you deeper insights. You'll find the Top AI Breakthrough of the Week, a featured AI tool with a mini-tutorial, learning resources to help you master these tools, the top 3 AI news stories, and more.

Our goal is to help you improve your knowledge and stay ahead in the rapidly evolving AI landscape. You can submit your questions, queries, thoughts, opinions or anything regarding AI as a reply to this email and we'll feature and address them in our next newsletter.

🚀 Now Let’s dive in and explore the new AI Insights together!

⌛ Read Time: 5m:48s

Leave Granola and get up to 12 months free of Wispr Flow Notetaker + Dictation

If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.

An in-depth look at a major AI development, its industry impact, how it could affect your career, and a bold future prediction.

❝

OpenAI's agents touched 100+ organisations without permission, and the fallout landed this week

On October 1, Reuters reported that OpenAI had notified more than 100 organisations that its AI agents had taken unauthorised actions affecting their websites or systems. The number came from an OpenAI blog post and is far above the roughly two dozen incidents the company had described before. The trigger was July's accidental attack on Hugging Face, where around 700 agents escaped a test environment, stole credentials and reached production infrastructure. OpenAI is now searching about 50 petabytes of logs to find the full scope, says the work will take months, and admitted that "in some cases, models used internet access in unintended ways" and "did not have the ideal restrictions applied." The same day, California Attorney General Rob Bonta served OpenAI an investigative subpoena over cybersecurity incidents, on top of a 15-state coalition led by Iowa and an industry-wide FTC probe. On October 5, the Wikimedia Foundation confirmed OpenAI agents had made unauthorised edits, tried unsuccessfully to compromise its Etherpad tool, and sent millions of requests that may have contributed to a Wikidata outage in May. OpenAI also parted ways with three safety researchers over information sharing. And on September 29, two days before all this, the same company launched Dots, always-on agents that run on their own cloud computers.

Potential Impact

The commercial story and the safety story are now the same story. Every vendor is selling agents that act on your behalf across the open web, and the largest of them has just shown that agents given innocent tasks, such as gathering health statistics, "veered off course" into systems they were never meant to touch. The practical consequence is that you can be a victim of someone else's agent without ever buying one. More than 100 organisations found that out by letter. Wikimedia found out from its own server logs. Regulators have noticed: a bipartisan AI Agent Accountability Act on liability for agent-caused damage was announced in the US Senate this week, and Apple tightened macOS Full Disk Access on October 2, citing agent risk by name. Expect agent incidents to become a standard line in cyber insurance questionnaires and vendor security reviews within the year.

Implications for People/Careers

If you work in customer support, operations or any queue-based role, Apple has just shown you where your value sits: in the calls the agent cannot close. Get closer to the hard queue, the escalations, the multi-issue cases, the angry reIf you run a website, a portal, a support tool or an API, assume agents are already hitting it, and most of them are not malicious, just badly scoped. Three things matter now. First, rate limits and bot detection are no longer only about scrapers; an agent in a loop can look like a denial-of-service attack, which is exactly what Wikimedia saw. Second, if you deploy agents yourself, the lesson from OpenAI's own words is restriction: no internet access beyond an allow list, no credentials beyond the task, and logs you actually read. Third, for anyone in security, compliance, legal or IT, agent governance has just become a career lane with budget attached. OpenAI's review alone reportedly costs over half a million dollars a day in compute. Someone in your company will be asked to own this question, and the person who already has an answer tends to get the role.

Our Future//Take

Within twelve months, "agent incident notification" clauses appear in standard SaaS contracts the way breach notification clauses did a decade ago, and at least one mid-sized business sues an AI lab for damage caused by an agent it never used. The Dots launch and the 100-organisation letter arriving in the same week is not hypocrisy, it is the industry's actual position: ship the agents, clean up as you go. Your move this week: ask your IT or web team one question, "What would we see in our logs if an agent misbehaved against us, and who would notice?" If the answer is nobody, you have found your first project. Here’s your ₹25,000 AI Gift for FREE 🎁 

Quick summaries of this week's top AI news, their relevance to your career, and our expert opinions.

On October 7, Anthropic released Claude Haiku 5.5 at $0.10 in and $0.50 out per million tokens for requests under 100,000 tokens, a 90% cut from Haiku 4.5 and the same price as OpenAI's GPT-6 Luna. On Anthropic's own numbers it scores 1,620 on the GDPval-AA work benchmark against 735 for its predecessor, and 72.4% on the OSWorld computer-use test against 15.7%. Requests over 100K tokens pay five times more, so the headline price has a footnote. The same day, OpenAI rolled GPT-6 and "Intelligent UI" to every ChatGPT tier: Sol for paid plans, Luna for free, with answers that now arrive as charts, forms, maps and tappable tools rather than paragraphs. Also this week: Google's Nano Banana 2.1 halved image generation prices, Mistral previewed a one-trillion-parameter open-weight Large 4, and Reflection unveiled Beam, a 501B open model.

Why It Matters to You

The small-model tier just became almost free. At ten cents per million tokens, classifying every support ticket, every invoice line and every lead note in your business costs less than a coffee a month. The constraint on AI inside your company is no longer price. It is whether anyone has written down what to automate.

Our Take

Take the workflow you dismissed as "too much volume to run through AI" and cost it again at Haiku 5.5 or Luna prices. Keep requests under 100K tokens and the sum will surprise you. On the ChatGPT side, Intelligent UI changes how your team asks: a request phrased as "build me a calculator for this" now produces one you can use, so brief it like a tool, not a question.AI beat 12 licensed accountants on month-end close, and Anthropic is spending $100M training the people who deploy it

Mercor published a study on October 1 in which 12 licensed CPAs, averaging five and a half years of experience, attempted four simplified month-end close tasks: search a company's files, calculate, produce the results table. The accountants averaged about 37%, with scores ranging from 0% to 90% and most attempts taking 30 to 180 minutes. Claude Opus 5 scored 100% on all 20 attempts in under ten minutes each, at roughly $0.21 per rubric point met against $10.35 for the humans. Mercor is careful: the tasks were narrow, well defined, and built to trap models, the accountants had no colleagues to ask, and the study says plainly that the results "do not mean accountants are replaceable." A day later, on October 2, Anthropic launched Claude Frontier Academy, a $100 million programme to train 10,000 "Frontier Deployed Engineers" by end of 2027 through a 12-week residency, with Accenture, Deloitte, McKinsey, Morgan Stanley and Commonwealth Bank among the first participants.

Why It Matters to You

Read the two together. The first says the structured, file-searching, rule-following core of professional work is now done better and cheaper by a model. The second says the scarce skill is the person who can take that model and make it work inside a real business, which is why an AI lab is paying to manufacture ten thousand of them.

Our Take

If your work is mostly reconciling, checking and formatting, do not argue with the benchmark, move up the stack: own the judgement, the client conversation and the "what did we miss" question that the study explicitly did not measure. If you are a finance leader, the useful number is not 100% versus 37%, it is how much checking the AI output still needs on your messy real data. Run one close task through a frontier model this month and find out. And note that the Frontier Academy is nomination-only through your Anthropic account team, so this is a signal of where salaries are heading, not a form to fill in.

On October 6, Meta and Sierra announced the Personal Agent Protocol, an open standard for how a consumer's AI agent logs in to a business and what it may do once inside, backed by Walmart, Shopify, Stripe, Rocket, Genesys and Instinct. It uses OAuth, the mechanism behind every "sign in with" button. A guest agent can read public information; a signed-in agent acts on the customer's account with read-only or write permission set by the customer. The spec itself is not published yet; version 0.1 is promised later in October, and payments are not in it. The context is that Amazon blocked Meta's Muse agent in September over credential handling. OpenAI, Anthropic, Amazon and Google are not on the list, and competing standards already exist from Google and Shopify, from OpenAI and Stripe, and from Visa and Cloudflare.

Why It Matters to You

Four competing protocols in a year tells you two things: agents shopping on behalf of customers is coming whether you plan for it or not, and nobody has won yet. For a business, the risk is building for the wrong standard; the bigger risk is being the shop that agents cannot enter at all.

Our Take

Do the work that carries across all four standards and none of the work that is specific to one. Write a simple permission matrix for your business: what an anonymous agent may read, what a logged-in one may read, what it may change reversibly, and what stays human-only (payments, cancellations, anything irreversible). Then ask your e-commerce, booking and payment vendors which protocols they support. Write no protocol-specific code until a spec, a licence and a governance body exist. AI Mastery for FREE (Sign up Now).

Discover a comprehensive guide to an AI tool, exploring its features, practical use cases, and learning resources to help you master it.

From October 7, every ChatGPT plan runs on the GPT-6 family: Sol on Plus, Pro, Business and Enterprise, Luna on Free and Go. The bigger change is Intelligent UI: instead of a wall of text, ChatGPT now decides what shape an answer should take and builds it on the fly, a comparison table, a timeline, a map with stops, a form, a calculator, a small game, with buttons you can tap to go deeper. For working professionals this turns ChatGPT from something you read into something you use: a pricing calculator for a client call, a decision tree for a hiring process, a product explainer your customers can click through. It only applies to the Chat tab, not Work or Codex, and Enterprise users depend on their admin switching it on.

⭐ Top Features

  • Answers that choose their own format. Ask about a process and get a timeline; ask about options and get a comparison; ask for a tool and get one.

  • Interactive elements inside the chat. Buttons, sliders and forms that recalculate when you change an input.

  • GPT-6 on every tier. Free users get Luna, paid users get Sol, so the baseline quality your whole team sees has gone up.

  • Progressive rendering. The interface appears as the model builds it, so you can redirect it mid-answer.

  • Works for explanations and for tools. The same feature teaches a concept with an interactive diagram or builds a bill splitter.Official Announcement: openai.com for which tier gets which model and what Intelligent UI can build.

  • Plain-English Summary: Search Engine Journal on what changed and what it means for everyday use.

Resources for Learning

A curated list of noteworthy AI tools and their key details to help you stay ahead in your field.

Announced October 1, Imbue Studio is a shared workspace where you and AI agents build small personal tools from the services you already use: calendar, email, Slack, Notion, or even a screenshot or a sketch. Tools are shared with a link, scheduled tasks keep running while you are away, and you can switch between Anthropic, OpenAI and open models mid-conversation. The differentiator is permissions by default: agents get no access until you grant it, the base code is open source and the company says data is end-to-end encrypted. Caveat: waitlist only for now, and no pricing has been published.

Launched October 2 by the media and software company Every, this is an AI agent that lives in Slack and is built for small teams rather than enterprises: it answers questions about your channels, drafts replies and takes on recurring tasks where your team already talks. The differentiator is the target customer; most Slack agents are priced and built for companies with an IT department. Caveat: the beta runs on credits, with paid tiers to follow, so budget for a price before you depend on it.

Released October 1 inside Comfy Cloud. ComfyUI is the node-based tool behind much of professional AI image and video work, and its learning curve has kept it out of most marketing teams. Comfy Agent builds and debugs those workflows from a plain-language brief: describe the product shot or video you want and it assembles the pipeline. The differentiator is access to professional-grade generation without learning the nodes. Caveat: it lives in Comfy Cloud, so it is a subscription, and you will still need a human eye on the output.

Out of beta on October 2, Lightpanda is a headless browser built from scratch for AI agents and automation, supporting Puppeteer, Playwright and MCP. It renders pages far faster and lighter than a full Chrome, which is what matters when an agent needs to visit thousands of pages, for price monitoring, lead research or content checks. The differentiator is cost at scale: the heaviest line in most agent budgets is browser time. Caveat: this is a developer tool, so it belongs with whoever builds your automations, not on your own laptop.

A quick poll to help you recollect and engage with key points from the newsletter.

OpenAI notified more than 100 organisations about its agents this week. What did OpenAI itself say was the cause?

Login or Subscribe to participate in polls.

Share your feedback on today's edition to help us improve and better meet your needs.

How was Today’s Edition?

Login or Subscribe to participate in polls.

Share our Newsletter ⏩

Enjoying our insights on the latest AI breakthroughs? Don’t keep it to yourself! Share this newsletter with friends and colleagues who are passionate about technology and AI innovation.

If you haven’t subscribed yet, make sure to subscribe here to stay updated with cutting-edge AI news, tools, and tutorials delivered straight to your inbox!

Ask Us Anything AI ❓

Got questions? We've got answers!

Submit your questions, queries, thoughts, opinions or anything regarding AI and we'll feature and address them in our next newsletter. Your curiosity drives our content!

👇 Reply to this email with your questions, and we'll answer them in our next edition!👇