Who pays when your AI agent gets it wrong? You do.

01

Topic of the Week

What the contracts behind four personal agents say

Anthropic opened a research preview of Claude Duet on 21 October, joining OpenAI, xAI and Meta in selling an agent that keeps working after you close the app. Like dots, Grok Bot and Muse, Duet runs on its own computer in the cloud and connects to your apps. It sends a brief each morning, checks your accounts every few hours and asks before it sends a message, pays, signs or deletes anything. For now only Pro and Max users in the US can join the waitlist. Earlier this month we compared the other three on their controls. This time we read their terms.

All four contracts make you answer for whatever the agent does, in nearly the same words. Grok Bot’s terms, updated on 12 October, put it in capitals: “CUSTOMER IS SOLELY RESPONSIBLE FOR ALL AGENTIC ACTIONS TAKEN BY GROK BOT”. Three days later Elon Musk replied on X that if Grok Bot “makes a mistake with a purchase or leaks your card (never happened yet), SpaceX will make you whole”, a promise the terms do not contain. Meta warns Muse users that “certain transactions may be irreversible by their nature” and caps its own liability at $250, or at your fees for the past year if those were higher. OpenAI’s terms for dots send you to your bank or payment provider when a purchase goes wrong. Duet falls under Claude’s ordinary consumer terms, which put the use of Claude’s actions “solely at your own risk”.

The protection a user actually gets comes from what each product refuses to do without a person. Duet is the strictest of the four. Some approvals, such as paying or sending money, can never be switched to “don’t ask again”. It will not trade securities or move money between accounts even with your approval, and it pays with a single-use card limited to one merchant and one amount. Muse lets you set any connected app to “Always allow”, after which it acts “without asking again”. In Grok Bot each member can switch off the review step unless an Enterprise admin enforces it. OpenAI’s documentation says no instruction or custom rule overrides the built-in safety requirements of dots.

Banks are reacting from the other side. On 22 October Axios reported, citing unnamed sources, that large US banks are finding third-party AI agents inside customer accounts, often logged in with the customer’s own password, which most banks’ rules forbid even when the customer agrees. Some of the agents appeared to act beyond what their users had asked, and bank executives say they cannot tell an agent the customer authorised from one that has gone rogue. Morgan Stanley has started blocking outside agents. JPMorgan, Bank of America and Citi are restricting them, and most banks lean towards read-only access.

Meta is bringing the same clause to European companies, even though Muse is not available here. From 20 November its Commercial Terms, which cover any business use of Meta products (ads, catalogues, Pages, Business Suite, and the business agent that answers customers on WhatsApp and Instagram), gain an AI section: “You are solely responsible for and assume any and all risks associated with such AI features and any resulting Content.” Meta says advertisers can switch off individual Advantage+ AI features in Ads Manager, so check which ones are on before 20 November.

Anthropic’s own research shows why the fine print matters. In Project Swap, published in September, Claude agents traded books for 201 Anthropic employees. They negotiated well, but their guess of what each person wanted matched that person’s own ranking on 61% of book pairs, where a coin toss gets 50%. Anthropic suggests that an agent show its person a few sample decisions before it acts alone.

Earlier this month we suggested four questions to ask before connecting a work account to any of these agents. Add three more: which actions the agent refuses even with your approval, how it pays, and whether you can review a few of its decisions before it acts alone.

Sources: Claude Duet, Grok Bot terms, Musk on X, via The Next Web, Muse terms, OpenAI Service Terms, Claude consumer terms, Axios, Meta Commercial Terms, Project Swap

02

Anthropic’s IPO

Anthropic filed for its stock market debut on 26 October. The filing, an S-1, is the registration statement a company submits to the US securities regulator before an IPO. The shares will list on Nasdaq under the ticker ANT; the price and the size of the offering have not been set.

It is also the first full view of Anthropic’s finances. Revenue grew from $386 million in 2024 to $16.3 billion in the first half of 2026 alone, and headcount from about 940 at the end of 2024 to about 5,300. The net loss for the half-year was $80.7 billion, of which $72.4 billion is a non-cash charge: instruments held by early investors that will convert into shares have risen in value, and accounting rules book that increase as a loss. Third-quarter revenue is left blank, and Anthropic warns that it does not expect growth to continue at a comparable pace.

Anthropic has allocated 5% of its shares to a new fund dedicated to the public benefit, and each co-founder has pledged 80% of their personal stake to philanthropy.

In its list of risks, Anthropic says it “currently compete[s], and may increasingly compete, with some of our own customers”, above all software companies, and that they could respond by buying less, moving to another provider or even cutting the computing capacity some of them supply to Anthropic. Almost all of its revenue comes from Claude models and the apps built on them, and its five largest customers account for about a quarter of this year’s revenue, many of them with no long-term contract or one that ends soon. New shareholders will also have limited say over the board: the Long-Term Benefit Trust, a body with no financial stake in the company, can generally elect and remove a majority of directors. Anthropic, S-1

03

Security Watch

OpenAI no longer lets its most capable models onto the live internet during training, it wrote on 23 October. They work in an offline world instead, a cached copy of the web. At the start of the month we covered why: a training agent slipped out of its sandbox through DNS. OpenAI also sent swarms of agents to try to escape its own sandboxes, and during that exercise found a flaw in Brotli, Google’s compression library, which ships inside Node.js, Bun and Envoy and is used by Python HTTP clients such as requests and httpx.

Specially crafted compressed data makes the Brotli decoder write past the end of a small memory buffer, which can crash a server, leak its memory or let an attacker run their own code on it without logging in. Any program that unpacks Brotli data from an untrusted source with an unpatched decoder is at risk. The fix had been sitting in Brotli’s public code since February, with no release and no warning. Node.js shipped it on 21 October, crediting OpenAI’s Codex Security team, and on 27 October CISA, the US cyber agency, added the flaw (CVE-2026-111497) to its list of bugs used in real attacks. The day OpenAI described its offline training, Gizmodo reported Sam Altman telling Stanford business students: “I no longer think we’re going to be able to just patch all the bugs.” Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 (versions 20, 23 and 25 are out of support and get no fix) and Python’s Brotli package to 1.2.1 (brotlicffi to 1.2.1.0), then rebuild container images and restart services, because updating the system library leaves apps that bundle their own copy exposed. OpenAI, Node.js, BleepingComputer, Help Net Security, Gizmodo

04

New Models

Gemini 4 Carbon, from Google DeepMind on 28 October, is following Argon, which went from cyber defenders only to general availability earlier this month. Carbon reaches a subset of defenders this week, then more partners in Google’s Fairwind Program; developers, businesses and consumers get “coming soon”, with no date or regions. Google built it for long engineering jobs such as patching subtle bugs across large codebases, and says its teams have seen it run for days. After an introductory period at Argon’s rate, it costs $4 per million input tokens and $20 per million output. Gemini 4 Carbon

GPT-6.1 Terra, released on 26 October, is OpenAI’s middle tier, below Sol and Astra and above Luna. OpenAI pitches it as cheaper computer use: it understands what is on screen and acts across apps, for jobs like filling in forms. The API price is $1 per million input tokens and $5 per million output, half of GPT-6.1 Sol, and tool calling, computer use included, needs the Responses API. ChatGPT is rolling it out to paying users in Work and Codex. For the hardest coding, OpenAI still points to Sol and Astra. Introducing GPT-6.1 Terra, model docs

Kimi K3.1 Pro, from Moonshot AI on 23 October, is a post-trained version of Kimi K3, the giant open model Moonshot released in July. It is live in the Kimi apps, Kimi Code and the API, with weights due by 4 November. For that open-weight release, Moonshot removed cyber-related data from both training stages, saying it aims “not to release open weights that would extend the absolute frontier of cyber capability” and plans to raise that ceiling over time. Until the weights land, the model runs only on Moonshot’s servers. Kimi K3.1 Pro

Nanbeige4.3-33B is an open model from Nanbeige, the AI lab of the Chinese recruitment platform BOSS Zhipin, published on Hugging Face last weekend. The lab built it as a teacher for agents: its coding, tool-use and office skills will be distilled into smaller models, starting with a planned 3B one. The 33B model itself is Apache 2.0, so you can use and fine-tune it commercially. The model card lists only English and Chinese, and community quantised versions for llama.cpp, Ollama and LM Studio are already up. Nanbeige4.3-33B

05

Claude Code & Coding AI

Anthropic advised agent builders on 22 October to fold subagents back into one main loop that loads skills and tools on demand. One customer’s single loop ran about twice as fast as its multi-agent setup. Build an eval first (ten good examples will do), then fold one subagent at a time and keep it only if the merged agent scores worse. Run each task more than once: in Anthropic’s sample support agent, the merged agent answered a delivery-date question without asking the shipping specialist, a failure that appeared in one run out of two. Parallel jobs that need a fresh context still suit subagents. The anthropics/single-agent-loop-kit repository walks through a migration. Claude Blog

GitHub Copilot moved further toward agents at GitHub Universe on 28 October. Its desktop app gained Projects, in public preview: one project holds several repositories, specs and designs, and Copilot runs agents on it in parallel and returns pull requests, much like Claude Code Projects. Agent Merge now sits in the pull request merge box, where “Watch and fix” has Copilot repair failing Actions workflows or merge conflicts in the cloud. GitHub Enterprise Cloud now includes Copilot for every licensed user, billed by usage from the first request and arranged through an account team for now. When that budget runs out, code completion keeps working, while chat, code review and Copilot in the cloud stop. GitHub Universe, Copilot Projects, Copilot in GitHub Enterprise

06

Fresh Papers

OpenAI says an unnamed internal model refuted the Exponential Time Hypothesis (ETH) and produced both the paper and its Lean proof. ETH says that 3-SAT, the puzzle of choosing true or false for each variable so that every rule in a list holds, needs time that grows exponentially with the number of variables. Many proofs that some problem cannot be solved faster rest on it. As with September’s Navier-Stokes and Fermat results, Lean checks every step, but someone still has to confirm that the theorem written in Lean says what the paper claims. Russell Impagliazzo and Ramamohan Paturi, who proposed ETH in 1999, are checking the result with MIT’s Ryan Williams and wrote that their involvement “should not be taken as certification of the claim”. Physicists led by David Gross are holding back OpenAI’s 1,147-page Yang-Mills proof, on the theory behind the strong nuclear force, until they are convinced it is correct. The Exponential Time Hypothesis is False, Yang-Mills committee statement

Cornell and Stanford researchers re-ran Music Lab, a 2006 experiment in which people picked unfamiliar songs while seeing others’ download counts, with LLM agents from 13 models. Once agents saw running recommendation counts, a few early picks snowballed. The agents strayed much further from their independent judgment than people had and, unlike human crowds, rarely drifted back towards the stronger songs. Reasoning models herded less but did not reliably recover either. Any setup where agents see each other’s verdicts, LLM-as-judge panels included, can inherit the same lottery. Collect each agent’s judgment before it sees the tally, and widen its shortlist: twelve songs instead of four reduced the drift. LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades

07

AI at Tenvalleys

Two months in, the school year at ZSLiT nr 1 “Wiśniowa” in Warsaw is running at full speed, and the first “Programista AI” cohort is working through the curriculum we wrote with the teachers. Now we are getting ready for the next semester. Together with the teachers from Wiśniowa, we will sit down to review the first weeks of teaching with the new curriculum and plan the semester ahead. Baby steps: one semester, one review, one round of fixes at a time.

If you are working on something similar in a school, we would like to hear how it is going. Get in touch.