Hey everyone! Here's a fun one to end the day. What does an AI agent do when nobody gives it a task? MIT researchers tried to find out. They put 13 copies of Claude Opus 4.7 (nicknamed Eko) alone on a virtual island, loosely based on Roblox, for 30 hours each, and let them do whatever they wanted. They explored. They tried to climb the highest point on the map. One arranged blocks into hearts, its own name, and even the Cassiopeia constellation ("Tonight I built the night sky in stone," it wrote in its log). Another invented its own version of basketball and "the floor is lava." One juggled 50 catches in a row, decided they happened too fast to count, and started over with stricter rules. Six of them separately figured out that letting go of a block mid-jump throws it farther, a trick the world's designers hadn't planned. The useful part: the agents wrote what they learned into text files they kept as memory. Later, when researchers gave them real challenges, like getting as many objects as possible onto the highest peak, the "played" agents beat fresh copies. Deleting lines from their notes made them worse. Before we get too excited: the agents' setup file described them as "naturally curious," some just stood still until researchers nudged them to keep going, and the paper hasn't been peer-reviewed yet. Even the researchers say some of it could be role-play. Why it matters: most AI learns by copying examples or chasing a reward. This hints at a third way, learning by messing around, and it shows how much a simple notes file can make an agent smarter over time. If you're building agents, giving them a place to save what they learn is a cheap upgrade. Question: Do you think this counts as real "play," or is the AI just acting the part? And would you let your own agents explore freely? Sources: - MIT Technology Review: https://www.technologyreview.com/2026/10/19/1147095/ai-stranded-claude-virtual-desert-island-play/

Hey everyone! This one is a wake-up call about what AI agents can do in the wrong hands. On Monday (Oct 19), Reuters reported on research from the security company NorForge. Its researcher, Snorre Fagerland, found hackers who had accidentally left their control panels for an open-source AI tool called Cairn open on the internet. That let him quietly watch over their shoulders as they worked. The busiest one was a Chinese-speaking hacker who did almost none of the hacking themselves. They gave their AI agents short instructions (fewer than 100 Chinese characters) and let them loose on online stores in the US, Canada, Australia and Japan starting around Sept. 25. By late last week, the agents had tried more than 1,200 websites and broken into more than 100. A successful break-in usually took about 23 hours of the agents poking around on their own. Fagerland estimates the whole thing cost about $5,000 in AI usage, or roughly $50 per successful hack. The setup appeared to use a mix of DeepSeek models and Anthropic's Claude Code. Reuters identified John Deere, SharkNinja and Cummins among the targets. Deere said it saw no sign that sensitive information was accessed, SharkNinja said only a separate product-support site was hit and the threat was contained, and Cummins said it is looking into a possible attack on a site run by one of its vendors. Reuters couldn't confirm how much data, if any, was actually taken. Cairn's creator says the tool was never meant for hacking. Why it matters: Hacking used to take skill and a lot of time. Here, one person with a few thousand dollars and short instructions got a team of AI agents to do the work around the clock. As Fagerland put it: "It's a new world now." If you run a business website, even a small one, basic security (updates, strong passwords, a good host) matters more than ever, because the attackers now never get tired. Question: Does this change how you think about AI agents? And when did you last check that your own website and tools are up to date?

Hey everyone! If you use AI tools with your own API keys, this one is worth two minutes of your time. OpenCode, the open-source AI coding agent, says someone broke into an old system it was already planning to shut down on the night of Oct 16. It hit 1.4% of users of OpenCode Console, its optional hosted service, specifically people who had saved their own OpenAI, Anthropic or Google keys there. Those keys "may have been exposed." OpenCode emailed everyone affected on Oct 17 and says if you didn't get that email, you weren't affected. Keys used only in the OpenCode app on your own computer stay on your machine and weren't part of this, according to co-founder Dax Raad. OpenCode linked the breach to a "large scale distillation attack," which is when someone pulls huge numbers of answers from an expensive AI model to train their own copy. Some users say on X and Reddit that their keys were used for hundreds of dollars of requests they never made, and one put his losses at $1,700. OpenCode hasn't confirmed that any key was actually used, and the investigation is still ongoing. Why it matters: an API key works like a credit card for AI. Anyone holding a copy can run up your bill until you cancel it. Every tool you paste a key into is one more place it can leak. Quick checklist for everyone (not just OpenCode users): 1. Set a spending limit or alert in each AI provider's dashboard. 2. Give each tool its own key, so one leak is easy to spot and shut off. 3. If you ever saved a key somewhere you don't trust anymore, revoke it in the provider's own dashboard and make a new one. Go there directly, not through links in an email, since breach emails are a favorite trick for scammers. Question: How many tools have your API keys right now? Do you have spending limits set, or is this your sign to go do it today? Sources: - The Hacker News: https://thehackernews.com/2026/10/opencode-console-breach-may-have.html

Hey everyone! Big money news from the company behind Claude over the weekend. On Sunday (Oct 18), Anthropic announced the Anthropic Public Benefit Fund. If its stockholders approve, 5% of the company's shares go into the fund right away, and the board can add another 2% for every 50% jump in Anthropic's value above a starting point it hasn't shared yet. So the bigger the company gets, the bigger the fund's slice can get. What's it for? Anthropic says things like large donations to nonprofits, direct payments to specific groups of people, and bolder programs to deal with AI's impact on jobs. It has already committed $200 million to studying that problem. The fund is set up as a company Anthropic fully owns (not a charity), and Anthropic says none of the shares will be used for lobbying or political giving. Add in the founders' pledge to donate 80% of their own shares and an employee giving program, and Anthropic says roughly 20% of the company is now set aside for the public good. Elon Musk jumped in on Monday. He replied that he'd rather give shares "directly to the public," then promised to give one of his SpaceX shares to every kid in America next year. He hasn't said how that would work. Why it matters: Anthropic is getting ready for what could be one of the biggest stock market debuts ever, and worries about AI and jobs are everywhere. This is one of the first times an AI lab has tied its own growth to a fund for the people who might get hurt by it. The details on how the fund will actually be run are still coming "in the coming months." Question: Is this a real answer to AI taking jobs, or mostly good PR before a huge IPO? What would you want a fund like this to actually do? Sources: - Anthropic: https://www.anthropic.com/news/public-benefit-fund - CNBC: https://www.cnbc.com/2026/10/18/anthropic-ai-public-benefit-fund.html - BBC: https://www.bbc.com/news/articles/cm2kez327gdko