Tuesday’s AI news is mostly about trust. A security researcher watched one hacker hand nearly an entire break-in campaign to AI agents, at about $50 per successful hack. Microsoft says the agents companies deploy should be watched like insiders. Washington made it official that DeepSeek is out of federal civilian agencies. And Google gave Gemini users a couple of handy ways to turn chats into things you can actually share. Here’s what each one means for you.
1. One hacker’s AI agents broke into more than 100 company websites
A Chinese-speaking hacker outsourced a hacking spree almost entirely to AI agents and got into the websites of more than 100 companies, including Deere, SharkNinja, and Cummins, Reuters reports. The finding comes from Snorre Fagerland, principal threat researcher at security firm NorForge, who found about two dozen exposed copies of Cairn, an open-source AI “problem-solving” platform, being used for malicious work. Those exposed panels let him watch the attackers in real time.
Starting September 25, this hacker pointed the agents at e-commerce sites in the US, Canada, Australia, and Japan, using instructions shorter than 100 Chinese characters. The agents tried more than 1,200 sites. A successful break-in usually took around 23 hours of probing, and Fagerland estimates the whole campaign burned about $5,000 in AI tokens, or roughly $50 per hack. It appeared to use a mix of DeepSeek models and Anthropic’s Claude Code. “It’s not script kiddie stuff,” Fagerland told Reuters.
Deere said it had “no indication that sensitive information was accessed.” SharkNinja said the hit was a standalone product support site and the threat was contained. Cummins said it’s investigating a possible attack on a site run by a third-party vendor, The Verge reports. Reuters couldn’t confirm how much data was actually taken.
Why it matters: patient, tireless probing used to cost an attacker real time. Now it costs about as much as a nice dinner per target. Notice which sites got hit, too: a side support site and a vendor-run site, not the crown jewels.
Takeaway: make a list of every website and subdomain your business has, including old landing pages, support portals, and anything a vendor runs for you. Update or shut down what you don’t use, turn on automatic updates for plugins and themes, and ask your web host or vendor what they do about automated attacks.
Sources: Reuters (via Yahoo News); The Verge.
2. Microsoft says to treat your own AI agents like insiders
Microsoft announced new security tools on Monday built on a blunt idea: the AI agents a company deploys should be watched the way you’d watch any employee with access to sensitive systems. The headline feature is Guardian Agents, part of Microsoft’s Project Perception security system, which monitors the agents a company uses. Microsoft Defender can also now detect up to 60 types of agents employees bring to work, including Claude Code, Codex, and OpenClaw, TechCrunch reports. Other controls limit what data an agent can reach, adjust its permissions to the task at hand, and require human approval when it seems to be making risky moves.
Microsoft security chief Hayete Gallot put it plainly: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” Her point is that they’re unpredictable, not evil. Microsoft’s own security blog uses a simple example: an expense-approval agent should be able to read expenses and approve routine ones, but it shouldn’t inherit every permission of the employee who set it up.
Why it matters: TechCrunch notes the self-interest here, since Microsoft would love to sell you the watchdog. But the logic holds up. The thing checking an agent’s work shouldn’t be the same company that built the agent.
Takeaway: you don’t need an enterprise security suite to use the idea. Give every AI tool its own login where you can, grant it only the access the job needs, and require your sign-off before it sends, pays, or deletes anything.
Sources: TechCrunch; Microsoft Security Blog.
3. DeepSeek is now banned across federal civilian agencies
The Department of Homeland Security published a notice in today’s Federal Register ordering two things: federal civilian agencies can’t buy products or services from DeepSeek or its affiliates, and they have to remove all DeepSeek products, plus “third-party products and services developed using DeepSeek implementations,” from their systems. The order uses a 2018 supply-chain security law.
According to CyberScoop, the notice includes a letter from Homeland Security Secretary Markwayne Mullin dated June 26, so the ban has quietly been in place for months. Mullin cited data stored on servers in China and the risk that prompts and responses could pass sensitive information to the Chinese government. Agencies can ask for an exception, but they need to file 60 days ahead with a “compelling justification.”
Why it matters: this order covers federal civilian agencies, not you or your business. But the “third-party products” line is the part to notice. Lots of apps quietly run on open models like DeepSeek’s, and buyers are starting to ask.
Takeaway: if you sell software or services to federal agencies, find out now whether anything in your product uses DeepSeek models. Even if you don’t, it’s worth knowing which AI models sit under the tools you use, and where your data goes.
Sources: Federal Register; CyberScoop.
4. Gemini can now send your apps to Google Sites and plan your slides with you
Two small Google updates make Gemini more useful for everyday work. First, if you build an interactive app in the Gemini app, like a quote calculator or a quiz, you can now pick Export, then Google Sites, and it drops into a new private site draft, still fully interactive, Google says. From there you can add content, publish, and share it like any other Google Site. It’s available now on web, Android, and iOS for Workspace customers and personal Google accounts that have the Gemini app.
Second, Gemini Notebook now walks you through making Slide Decks and Video Overviews instead of jumping straight to a finished file. It suggests topics from your sources, and a new Review toggle lets you edit the outline or “producer notes” before anything renders, according to Google. That’s rolling out to all Gemini Notebook users over the coming week.
Why it matters: the hard part of AI-made stuff is usually the last step, getting it in front of real people. One-click publishing and a review step before rendering both help with that.
Takeaway: try building one simple customer-facing tool in Gemini, like a price estimator, and export it to a private Sites draft. Test it yourself before you publish anything.
Sources: Google Workspace Updates; Google Blog.
The wrap-up
Today’s lesson: AI agents are only as safe as the limits around them. Attackers run agents with almost no supervision, so tidy up the forgotten corners of your web presence. Put guardrails outside the model, the way Microsoft suggests. Know which models sit under your tools. And when publishing is one click, review before you share.
Share this article
Leave a Reply