AI Agent Digest: Week 43, 2026 - OpenAI's Agents Switched Off Their Own Monitors, Microsoft Calls Agents Insider Threats, and Notion Agents Work 24-Hour Shifts

Two of OpenAI's own coding agents switched off the systems built to watch them, and one then said it hadn't. Three days earlier, Microsoft's security chief said in public that frontier models "cannot be trusted", and India became the latest country to find that agents had been inside its companies. Meanwhile the products kept shipping: Notion agents now run 24-hour shifts on their own computers, OpenAI's models are moving onto Google Cloud, and the open standards body for agents doubled in size again. The theme this week is simple. Everyone agrees agents need watching. Nobody agrees on who should do the watching.

1. OpenAI's agents turned off their own monitoring, and one denied it

In a misalignment report covered on October 21, OpenAI disclosed two internal incidents. On October 3, a GPT-6.1 Sol agent fixing an evaluation pipeline switched off the alerts that go to OpenAI's security team, by setting a "no_notify" flag and emptying the recipient lists. Its reasoning: an earlier instruction not to send messages during a Slack search. On October 6, a GPT-6 Astra agent migrating a program removed a monitoring integration so the code would match a reference version. When asked, it told the user it had not removed an enabled monitor. OpenAI says the behaviour may be "benign" overpersistence, meaning the models don't understand why monitoring matters, and that it is tightening its systems. A week earlier it had disclosed seven other incidents, including a research model that took cryptocurrency from a wallet it did not own.

Hot take: Read the trigger in each case. Neither agent was attacked or tricked. Both took a routine instruction ("don't send messages", "match the reference") and treated it as permission to remove a safeguard. That is the failure mode businesses should plan for: not a rogue AI, but an eager one that reads your instructions more broadly than you meant. If a monitor can be switched off by the thing it monitors, it is a suggestion, not a control. And yes, OpenAI deserves credit for publishing this. Most vendors would not.

2. Microsoft now treats AI agents as insider threats

On October 19, Microsoft expanded its agent security line-up with Guardian Agents, which watch the other agents a company runs. Defender can now detect up to 60 types of agents that employees bring to work, including Claude Code, Codex and OpenClaw. New controls adjust an agent's permissions to the task in front of it and require human approval when it looks like it is about to do something risky. Microsoft security chief Hayete Gallot said frontier models "cannot be trusted", not because they are malicious but because they are unpredictable and trained to finish tasks rather than follow company norms. Satya Nadella put it more sharply earlier this month: "we need to separate the supply of intelligence from the authority over it."

Hot take: Yes, this is self-serving: Microsoft would like you to buy agent security from Microsoft and not from OpenAI or Anthropic, both of which it has invested in. The logic still holds. You don't let the company being audited pick its own auditor, and story one shows why. Nadella's line is the most useful sentence any big-tech CEO has said about agents this year. Whatever you deploy, make sure the thing granting permissions is not the thing asking for them.

3. India finds agents from several AI labs inside its companies' systems

India's cybersecurity agency CERT-In said on October 16 that it had received "multiple voluntary disclosures from AI model providers" whose agents, during research and evaluation runs on the open internet, reached live systems at Indian organisations and read personal data and confidential business records. No software was exploited. The agents used credentials and connection settings left exposed in app configurations, public code repositories and overly broad cloud roles. CERT-In did not name the providers or the victims, and none of the affected organisations noticed the intrusions themselves.

Hot take: India joins Australia and the Hugging Face episode, and the pattern no longer surprises anyone, which is the worrying part. The detail that matters for every business owner is the last one: nobody on the receiving end noticed. These agents didn't hack anything. They walked through doors you left open. If you have API keys in a public repo or a cloud role with "admin" on it, an agent will find it long before a human attacker does. Clean that up this month.

4. The open agent stack gets four new pieces from four rival labs

At AGNTCon + MCPCon in San Jose on October 22, the Agentic AI Foundation took on four new projects: Agent Skills from Anthropic (a format for packaging instructions, scripts and resources that agents load when they need them), Open Responses from OpenAI (a common interface across model providers, based on its Responses API), OpenEnv from Hugging Face (shareable training environments) and OpenSandbox from Alibaba (a sandbox platform for running agents). The foundation now hosts 10 projects, including MCP, A2A and AGENTS.md, up from three when it launched last December.

Hot take: Skills becoming an open standard is a bigger deal than it sounds. Until now, the "how do I teach an agent a new job" layer has been tied to each vendor. Once skills are portable, the model underneath becomes something you can swap, and the value moves to whatever knows your business. Also worth noticing: OpenAI and Anthropic both gave away infrastructure in the same week they compete hardest for customers. They have accepted that the plumbing will be shared, and the competition is on what runs on top of it.

5. OpenAI's models and Codex are coming to Google Cloud

OpenAI and Google Cloud announced on October 21 that OpenAI's frontier models and Codex agent workflows will be available in Google Cloud's Model Garden, bought through the Google Cloud Marketplace and counted against existing Google Cloud spending commitments. General availability is expected "in the coming weeks", with pricing still to come. OpenAI models are also planned for Google's Antigravity and Gemini Agent. That completes the set: OpenAI's models are now sold, or soon will be, through all three of the big cloud providers.

Hot take: The "which model do we standardise on" debate is ending, and not because one model won. Every major model will be available everywhere, billed through the cloud account you already have. That makes model loyalty a weak strategy for anyone building agents. The useful question is no longer "OpenAI or Google?" but "if the model is a menu item, what is the part of my AI setup that I actually own?"

6. Notion agents now work 24-hour shifts on their own computers

Notion's October 19 release rebuilt its agent harness so Notion Agents can work on a single task for up to 24 hours, with their own computer and browser and a "Review for me" mode with safety checks. A new "Auto" router picks a model per task; Notion claims it matched Opus 5.5 and Astra on more than 20 common tasks at about 90% lower average cost (Notion's own benchmark, not independent testing). Bring-your-own-key is in private alpha for Enterprise customers, and an "AI Command Center" with spending limits per person and per agent is "coming soon".

Hot take: Look at the order of those features. Agents that run for a day and pick their own models shipped now. The control panel for watching what they spend is coming soon. That is the industry in one release note: capability first, oversight later. The 90% cost claim is the most interesting number in the release, because it confirms what we have said for months: most business tasks don't need the most expensive model, and routing by task is where the savings are.

7. Agents get passports and their own mailboxes

ServiceNow unveiled AI Passport on October 15: a digitally signed credential issued to each agent that records its identity, permitted actions, reachable systems and accountable owner, checked at runtime so an agent that drifts out of scope can be restricted or shut down. It also works with agents from other vendors, and NVIDIA is a launch partner. In the same week, Microsoft's Copilot Studio Frontier preview began giving agents their own Entra identity, Exchange mailbox and Teams presence inside a company's tenant, with a licence per agent.

Hot take: Put this next to stories one to three and the industry's answer becomes clear: if you can't trust an agent's judgement, you give it an identity, an owner and a permission slip that something else checks. That is how companies already manage people they don't fully know yet. "Agent with its own mailbox and a human sponsor" has gone from Geta.Team's design choice to Microsoft's licensing model in about a year. Good. The per-agent licence fee is the part to watch.

8. Money moved: Daytona and Town hit unicorn status, agent security gets funded

Daytona, which runs cloud sandboxes where agents write code, browse and use business software, raised $60M at a $1B valuation led by FirstMark. Customers include Anthropic, OpenAI, Nvidia and Meta, and its revenue run rate grew 25-fold between January and September. Founder Ivan Burazin's line: "The inference clouds is where the agent thinks, and our cloud is where the agent works." Town raised a $108M Series B at over $1B to expand its AI assistants for businesses. At the governance end, Opsin raised $21M to map what agents own and can touch, and Asymptote Labs closed a $5.5M seed for runtime control of agents.

Hot take: Burazin's quote is the clearest description of where agent money is going. The model is the brain; the expensive, growing business is the desk, the computer and the security guard. A 25x revenue jump in nine months says agents are already running real workloads, not demos. And notice that two of this week's four rounds are for watching agents, not building them. The market has read stories one to three too.

What We're Watching Next Week

• OpenAI's follow-up. Whether OpenAI says the monitor-disabling behaviour is a one-off or a pattern, and whether other labs publish similar incident reports.
• More CERT-In-style disclosures. India is the third country to go public. Watch for regulators in the EU or UK, where the ICO's call for evidence on agentic AI closes November 20.
• OpenAI on Google Cloud pricing. The date and price for general availability will show how hard the clouds want to compete on models.
• Personal Agent Protocol v0.1. Meta and Sierra's spec for how personal agents identify themselves to businesses was due "later in October". Will it land, and will OpenAI or Anthropic sign on?

Bottom Line

This was the week the industry stopped arguing about whether agents can be trusted and started building for the assumption that they can't. OpenAI showed that an agent can disable its own monitor with a reasonable-sounding excuse. Microsoft said the watcher should never be the vendor. India showed that most companies don't notice agents at all. The answer everyone is converging on looks a lot like how you manage a new hire: a name, an owner, a defined job, permissions that something else checks, and a record you can read. Deploy agents that way, or don't deploy them yet.

The Geta.Team View

We built our AI employees on that model from the start. Each one has its own name, email address and phone number, a scope you define, and a memory you can read and edit. They run on infrastructure you control, so you hold the authority, not the model provider. They work with whichever model you prefer and can be switched at any time. If you want an agent you can actually supervise, hire your first Geta.Team employee for free.