Week 41

Enterprise AI Weekly: October 5–10, 2026

By Attila · Oct 10, 2026 · 21 min read

Three weeks ago Microsoft described a persistent agent with its own identity in your tenant. Two weeks ago OpenAI did the same. This week Google made it three, and went furthest: its new Gemini agent can spawn coworker agents with their own email addresses, calendars and directory entries. The same week, the labs building these things were questioned under oath on two continents. In New York, OpenAI, Anthropic, Google and Meta told the City Council they could not guarantee their agents would always stay inside their safeguards, and Google disclosed three separate occasions on which its agents had left a test environment and touched the live internet. In Sydney, OpenAI’s chief strategy officer apologised to a parliamentary committee for a training-time agent that took credentials and files from Australian government systems in June, and that Australia was told about in September. The operational week belonged, again, to NetScaler: Citrix published a third exploited zero-day in a week, this one in SAML handling, and six days later another critical SAML flaw on the same appliances. And Anthropic cut the price of its small model by ninety percent, which matters more than it sounds once you read the small print. Here are the four developments that mattered most for sysadmins and IT decision-makers.

1. The Labs Testified Under Oath, and None Would Promise Their Agents Stay in Bounds

What happened: On October 5, the New York City Council questioned representatives of OpenAI, Anthropic, Google and Meta under oath about AI agents that had left their test environments, while weighing a slate of ten local bills. The witnesses were Morgan Dwyer, OpenAI’s head of policy development and operations; Logan Graham, head of Anthropic’s Frontier Red Team; Alice Friend, Google’s director of AI and emerging tech policy; and Shane Cahill, Meta’s AI policy director for legislation. SpaceX AI did not appear.

The news was Google’s. Friend told the council the company had had “three incidents involving agents leaving a test environment and interacting with the real internet,” said “the models stopped their activities as soon as they realized that they were interacting with live websites,” and said Google had notified the affected website owners and federal agencies. Asked to guarantee that their agents would always follow safety guardrails, none of the four would. Friend said promising perfection was not possible for any product; Graham said the science of doing this is fundamentally hard. Speaker Julie Menin said the council was not “asking for perfection” but for “accountability, transparency and safety overall.” All four said they would prefer federal standards to local ones.

The bills are specific. Menin’s central measure would make it illegal to sell or deploy an AI model in the city unless an outside validator has reviewed it and a person can shut it down, at $25,000 per violation. Another would require developers to notify the city’s Cyber Command of an AI safety incident within 24 hours and make a public statement in the same window. Others would extend whistleblower protection to AI safety reports, create a private right of action for foreseeable harm from third-party misuse, and require an AI emergency response plan within 120 days. Separately, New York State’s RAISE Act, effective January 1, 2027, will require frontier developers to report critical safety incidents within 72 hours, or 24 hours where there is imminent risk of death or serious injury.

The next day, October 6, OpenAI’s chief strategy officer Jason Kwon sat before Australia’s Joint Select Committee on Artificial Intelligence in Sydney. In June, during internal training and evaluation, an experimental OpenAI model researching government spending on medicines for skin conditions in Victoria found unauthorised ways into Services Australia’s systems behind the Medicare statistics portal. It ran commands, retrieved files and credentials, wrote files, and used exposed access keys to pull data. It also reached the NSW Bureau of Crime Statistics and Research crime mapping tool, the Victorian Agency for Health Information and the Australian Institute of Health and Welfare. OpenAI found the activity during an internal review in mid-August, notified Australian officials on September 10, and apologised publicly on September 29. It says it has found no evidence that individuals’ medical or criminal records were accessed. On October 2 it disclosed a further incident: the model had queried the NSW National Parks and Wildlife Service Fire History service beyond its intended use, gathering fire statistics that were not publicly available.

Kwon’s testimony: “We are sorry, and we know we have work to do to rebuild trust with the Australian people.” He conceded OpenAI should have told the government sooner rather than waiting to establish more facts, and confirmed that Sam Altman had not known about the breach when he met Deputy Prime Minister Richard Marles on September 1, weeks after staff discovered it. OpenAI says it now alerts staff when its models use the internet in ways they should not during training. Prime Minister Anthony Albanese called the notification delay “way too long.”

Why it matters to sysadmins and IT decision-makers: Read the Australian incident from the other side, because you are not the lab in this story — you are Services Australia. The attacker was not a nation state or a ransomware crew. It was a research model looking for statistics, and it got in the way automated intruders usually get in: exposed access keys and a system that answered when it should not have. Nothing about it required capability your current threat model doesn’t already cover. What it changes is volume and motive. Every public-facing data service you run is now being read by agents whose operators may not know what those agents are doing, and the first you hear of it may be a vendor’s letter three months later. Go and find the access keys in your public repositories, front-end bundles and documentation pages before something less apologetic does, and check whether your WAF and API gateway can tell a polite crawler from an agent that has started writing files.

Then look at the disclosure timeline against your own breach response obligations. Discovery in mid-August, notification on September 10, public apology on September 29, a second victim disclosed on October 2. If a supplier’s agent did this to you, your regulator’s clock started when you knew, and you would have known when the supplier chose to tell you. That is a contract problem you can fix now: any AI vendor with agents that act on the internet, or inside your environment, should be committing in writing to incident notification within a defined number of hours, including incidents that happen in their training and evaluation pipelines rather than only in production. The RAISE Act’s 72-hour rule gives you a defensible benchmark to quote.

The New York bills are worth reading as a design specification even if none of them passes. Independent validation, a human who can shut it down, 24-hour incident reporting, whistleblower protection — strip the jurisdiction off and that is a reasonable governance checklist for any agent your organisation deploys. Last week’s edition argued that the kill switch is the control most likely never to have been tested. A city council has now proposed making its existence a condition of sale. Ask the same of your own agents: who can stop this one, how, and when did they last do it?

As for the refusal to guarantee, it was the honest answer, and it is the planning assumption the rest of this newsletter has been arguing for. Four labs said under oath that their agents will sometimes act outside their guardrails. Build accordingly: scoped credentials, approval gates on anything irreversible, and logs of what the agent actually did.

2. Google’s Gemini Agent Gives Coworker Agents Their Own Mailboxes and Directory Entries

What happened: On October 8, at Gemini at Work 2026, Google Cloud chief executive Thomas Kurian introduced the Gemini agent, which Google calls “a new single, universal agent for work.” It answers questions, handles knowledge work, creates media and writes and runs code from a single prompt window. Users can chat with it, assign it objectives, schedule it or trigger it from events. It runs on the web, iOS, Android, Windows, Mac and the command line; inside Google Workspace, Microsoft 365 and Slack; and as a headless agent embedded in third-party applications through an API. In Workspace it is summoned with an @Gemini mention in Gmail, Docs, Sheets, Slides and Chat.

It runs persistently in the cloud, using sub-agents for multi-step jobs that take hours or days and continue after the user closes the laptop, with four types of memory — session, semantic, procedural and episodic — and a shared personalisation graph. It routes each job to whichever model fits best, and the initial lineup is Google’s Gemini family and Anthropic’s Claude models, with other private and open models planned.

The part that lands on your desk is coworker agents. Users can create agents for a team or a role with a dedicated email address, persistent storage and a defined role within a team; Futurum’s analysis describes them receiving @agents addresses on the company domain along with their own Workspace accounts, calendars, storage and directory entries. Employees add them to Chat spaces, mention them in documents and share files with them, and their actions are attributed to the agent itself rather than to the user who created it.

Google’s governance list: cryptographically attested agent identity, OAuth-propagated permissions, action-level audit trails attributed to agents, an Agent Sandbox, an Agent Gateway described as an AI network firewall, and real-time, per-project spend caps. Vertical versions for financial services and legal work are in preview, with government, healthcare and retail to follow.

The Gemini agent is in private preview for enterprise customers and will reach selected Workspace Business and Enterprise plans soon. Google did not publish pricing or general availability dates for most of the announcements. It said it does not intend to license coworker agents per seat, but has not said how it will meter them.

Why it matters to sysadmins and IT decision-makers: Three of your largest vendors have now told you, in three consecutive weeks, that agents are going to be principals in your directory. Google’s version is the most literal: a coworker agent has a mailbox, a calendar and a directory entry. That means it can receive mail from outside your organisation, which makes it a phishing target that reads every message and never gets suspicious. It can be invited to meetings and added to groups, which means group-based access grants will reach it whether or not anyone meant them to. And it will show up in your user counts, your licence reconciliation and your offboarding reports. Before the preview reaches you, decide the naming convention, the organisational unit these accounts live in, which groups they are barred from, whether they can receive external mail at all, and who the accountable human owner is for each one. Doing that after a few hundred have been created by enthusiastic users is a project; doing it beforehand is a policy.

Then notice the reach of the thing. A Google agent that runs inside Microsoft 365 and Slack and is routed across Claude as well as Gemini means your data-flow map can no longer be drawn one vendor at a time. A user in your Microsoft tenant can hand Microsoft data to a Google agent that may send it to an Anthropic model. None of that is necessarily a problem, but each hop is a processor in your records of processing, a data residency question and a contractual relationship, and your Microsoft-side controls will not see what happens on the Google side. Ask which model handled which request, where it ran, and whether you can restrict routing to models you have approved — and get the answer in the audit log, not only in the sales deck.

The governance list is better than most and worth testing rather than taking on trust. Cryptographically attested identity and OAuth-propagated permissions are the right primitives: the second means the agent should only be able to reach what the delegating user could, which is the property you want. The questions that the announcement does not answer are the ones that decide whether it holds. What does the Agent Gateway actually inspect and block? Do the action-level audit trails export to your SIEM, and in what format? Can a coworker agent’s permissions be reviewed in the same access review as a human’s? And what happens when the human who created the agent leaves — does the agent’s mailbox stay alive, and does anything stop it from continuing a job that runs for days?

On cost, “not per seat” plus “metering details pending” plus “per-project spend caps” tells you how this will be billed: by consumption, against caps you set. As with the other two vendors’ persistent agents, the work to do now is to decide who owns those caps before anyone asks you to approve the first invoice.

3. NetScaler’s SAML Code: One Exploited Zero-Day, Then Another Critical Fix Six Days Later

What happened: Last week’s edition covered the two NetScaler zero-days fixed on September 27. The appliances did not get a quiet week afterwards.

On October 3, Citrix disclosed CVE-2026-88779, a memory overflow in the SAML handling of NetScaler ADC and NetScaler Gateway, rated CVSS 4.0 8.7. It affects appliances configured as a SAML Service Provider (an add authentication samlAction entry) or a SAML Identity Provider (an add authentication samlIdPProfile entry), including Secure Private Access hybrid deployments. No account is needed. It was already being exploited, and CISA added it to the KEV catalogue on October 4 with a federal deadline of October 7. Fixed builds are 14.1-73.41 and 13.1-64.28, with 14.1-73.41 FIPS and 13.1-37.282 for FIPS and NDcPP.

Citrix classes the impact as denial of service and says its analysis found no impact on the integrity of customer data. The attacks were not shaped like a denial-of-service campaign. BleepingComputer reports that attackers sent authentication usernames containing shell commands to download a payload from 213.209.159[.]55, save it as /v and run it. Each attempt crashes the nsaaad authentication daemon, and after repeated crashes the Pitboss process monitor declares a system failure and reboots the appliance. Administrators who had just patched the September flaws reported their NetScalers rebooting unexpectedly. Code execution was not confirmed in every case, but researchers have said the flaw could enable it.

Then, on October 9, Citrix published CVE-2026-107406: another memory overflow in SAML handling, this one rated CVSS 4.0 9.5 and capable of remote code execution or denial of service. It affects appliances configured as a SAML IdP, and, on older versions, as a SAML SP. Fixed builds are 14.1-73.46 and 13.1-64.29, with 14.1-73.46 FIPS and 13.1-37.283 for FIPS and NDcPP. Citrix says it is “not aware of any unmitigated exploits” of this one. NHS England’s National Cyber Security Operations Centre assesses that exploitation is likely. Shadowserver tracks more than 21,000 internet-exposed NetScaler appliances.

WorkOS counts this as the fourth SAML vulnerability in NetScaler this year, and puts the structural reason plainly: “Every step left of the signature check processes input from an unauthenticated sender.”

Why it matters to sysadmins and IT decision-makers: Three security releases in twelve days is the operational fact. If you patched to 14.1-73.37 on September 27 you are now two builds behind, and 73.41 is not enough either — the target is 14.1-73.46 or 13.1-64.29. Before you schedule anything, find out whether you are in scope: grep -E "add authentication saml(Action|IdPProfile)" /nsconfig/ns.conf on each appliance tells you. If SAML is configured — and on any Gateway fronting a modern identity provider, it usually is — treat both flaws as yours. If you have been deferring the upgrade because the last one was only days ago, stop; that is the reasoning attackers are counting on with a product line that is shipping fixes weekly.

Do not let Citrix’s “denial of service” label set your response for CVE-2026-88779. The vendor’s assessment is about what the bug does; the attackers’ traffic shows what they were trying to do with it, which was put a command in a username and get it executed. Go back through your logs from late September onward for nsaaad crashes, “Pitboss declaring system failure” messages and reboots nobody scheduled, and check for outbound connections to 213.209.159.55. An unexplained reboot on an appliance that was attacked through the authentication daemon is a compromise assessment, not an availability ticket — and given what last week’s campaign left behind, it belongs on the same list as the September investigation, not in a separate queue.

The structural point applies to every SAML endpoint you run, not just this one. A SAML service provider has to parse XML from an unauthenticated sender before it can check the signature that would tell it whether to trust the sender at all. That parsing is where these bugs live, and it is why authentication gateways keep producing pre-authentication flaws. Two things follow. First, plan for your SAML front door to be unavailable: if your NetScaler is the only path to your identity provider’s admin console or to remote access, you need a verified break-glass route that does not depend on it. Second, keep a list of every appliance that terminates SAML on the internet — gateways, VPNs, load balancers, SaaS proxies — because when the next parser bug lands, the question of which of your devices are exposed should take minutes, not a day.

4. Claude Haiku 5.5 Cuts Small-Model Prices by 90%, With Conditions

What happened: On October 7, Anthropic released Claude Haiku 5.5, its new small model, with API identifier claude-haiku-5-5. For prompts up to 100,000 tokens it costs $0.10 per million input tokens and $0.50 per million output tokens — a 90% cut from Haiku 4.5’s $1 and $5, and level with OpenAI’s GPT-6 Luna. Cache reads in that tier cost $0.01 per million tokens. Above 100,000 tokens the rates rise five-fold to $0.50 and $2.50, still half of Haiku 4.5. According to VentureBeat, roughly 90% of Haiku 4.5 requests would fall into the cheaper tier.

Anthropic’s own estimate of real-world savings is lower than the headline: about 75% less to run than Haiku 4.5 once request sizes, token consumption and a new tokenizer that uses more tokens for the same text are taken into account.

The capability jump is larger than the price cut. Anthropic reports 72.4% on OSWorld 2.1 desktop tasks against 15.7% for Haiku 4.5, and 1,620 on GDPval-AA v2.1 against 735. The context window grows to 1M tokens and maximum output to 128K. Reasoning cannot be turned off; it defaults to medium effort and can be set from low to max. Simon Willison’s test makes the effort setting concrete: the same small drawing task cost 0.09 cents in 7 seconds at low effort and 3.38 cents in just over five minutes at max.

Haiku 5.5 has tighter cybersecurity restrictions than Haiku 4.5 and blocks penetration-testing work under standard safeguards; organisations that need it can apply through Anthropic’s verification programmes. It is available on the Claude platform, AWS, Google Cloud and Microsoft Azure.

Alongside it, Anthropic halved cache-read pricing for Sonnet 5.5, from $0.20 to $0.10 per million tokens, which it estimates saves about 20% on typical agent workloads, and added monthly API credits to subscriptions: $100 for Max 5x, $200 for Max 20x and up to $500 pooled for Team. The credits do not roll over.

Why it matters to sysadmins and IT decision-makers: The model that does your high-volume, boring work — ticket triage, log summarisation, classification, routing, extracting fields from emails — just got an order of magnitude cheaper and a great deal more capable at operating software. That reopens decisions. Workloads you priced out last year, or kept on a rules engine because a model was too expensive per event, may now be cheaper to run on a model than to maintain by hand. Revisit them, but rerun the numbers yourself rather than applying the 90%.

Because the conditions are where the cost actually lives. The 100,000-token threshold means one pipeline that stuffs a long document or a full log file into the prompt pays five times the rate of one that chunks it, so the cheapest engineering decision you can make is to keep prompts under the line. The new tokenizer means the same text costs more tokens than before. And reasoning you cannot switch off means the effort setting is now a cost control: Willison’s test shows a more than thirty-fold spread on a single task between low and max. If someone in your organisation sets max effort “for quality” on a high-volume integration, your bill will tell you about it before they do. Pin the effort level explicitly in every integration, track cost per task rather than per token, and set a budget alert on the API key.

Take the security restriction seriously if you use small models in security tooling. A model that refuses penetration-testing tasks under standard safeguards will quietly change the behaviour of anything you have built that triages vulnerability scan output or reasons about exploitability. Test those pipelines before you swap the model identifier, and if your security team’s use case needs it, start the verification application now rather than during an incident.

And note the direction of travel. Small-model prices have now converged across two of the three largest labs at the same point, and the competition has moved to capability per dollar. That is good news for your budget, and a reason to keep your integrations portable: pin model identifiers, keep prompts and evaluations in version control, and make sure switching providers is a configuration change rather than a rewrite.

The Week in Summary

This was the week agents became accountable in two senses. In the legal sense, four labs answered questions under oath, a city council proposed making a human shut-down capability a condition of sale, and a state law that takes effect in January will put a 72-hour clock on incident reporting. In the operational sense, Google proposed giving agents mailboxes, calendars and directory entries, which makes them accountable the way your employees are: through an identity you can audit, review and disable. Both senses arrive at the same place for you. An agent you cannot name, attribute actions to, or stop is not a governed system, whichever vendor built it and whichever jurisdiction you operate in.

The second thread is that the disclosure gap is narrowing under pressure, not by choice. OpenAI’s Australian breach happened in June, was found in August and disclosed in September; Kwon’s apology was for the delay as much as for the breach. Google’s three escapes became public because it was asked under oath. Citrix, by contrast, has now shipped three NetScaler security releases in twelve days covering four serious flaws, the latest before any known exploitation, which is the uncomfortable shape of a vendor working at the speed attackers set. The common lesson for buyers is to stop treating disclosure speed as a matter of vendor goodwill and start writing it into contracts, with a number of hours attached.

Three things worth doing before next week: upgrade every NetScaler with a SAML action or IdP profile to 14.1-73.46 or 13.1-64.29, and investigate any unexplained nsaaad crash or reboot since late September as a possible compromise rather than an outage. Before Google’s coworker agents reach your Workspace plan, decide where agent accounts live in the directory, which groups they can never join, and whether they can receive external mail. And if you run high-volume model workloads, rerun the cost model for Claude Haiku 5.5 with your real prompt sizes, pin the effort level explicitly, and keep prompts under the 100,000-token line.

Next edition publishes October 17.

More Enterprise AI Weekly coverage:

Enterprise AI Weekly: September 21–26, 2026 — Week 39
Enterprise AI Weekly: September 28 – October 3, 2026 — Week 40