AI Agent Digest: Week 46, 2026 - Claude Learns to Delegate, a 'Don't Ask Again' Button Leaked 1,122 Files of Secrets, and 79% of Enterprises Have Agents in Production

One button connects most of this week's news. It reads "Yes, and don't ask again." In nine stories, a system remembered a permission, a credential or a deployment longer than anyone meant it to. The difference this week was that someone went and counted.

1. Claude Learns to Delegate: Fable 5.2 and Mythos 5.2

Anthropic released Claude Fable 5.2 and Claude Mythos 5.2 on 9 November. Both are priced at $8 per million input tokens and $40 per million output tokens, with a fast mode at double that. Fable 5.2 is open to everyone, with cybersecurity and biology safeguards. Mythos 5.2 is limited to organisations in Anthropic's verification programmes. The agent detail is the interesting part: Fable 5.2 can act as an Advisor that smaller Claude models consult on hard problems, or as an Orchestrator that hands simpler tasks down to them.

Hot take: The headline is the org chart, not the benchmark. Anthropic now ships a model meant to sit above other models and decide who does what, so "which model do we use" has become "which model manages which". That is a staffing question, and most teams still answer it in a config file nobody reviews.

2. "Don't Ask Again" Leaked 1,122 Files of Credentials to Public GitHub

Researchers at Apiiro found 1,122 publicly accessible Claude Code settings files containing live secrets. When a developer picks "Yes, and don't ask again", the full command, embedded passwords included, is saved to .claude/settings.local.json. That file is meant to stay local. It does not stay local if it is already tracked by Git. A wider search found 2,539 distinct credentials across 1,994 repositories belonging to 63 organisations. Boris Cherny, who leads Claude Code, said the team is exploring built-in credential scanning. No fix date has been announced.

Hot take: This was not an AI failure. A permission was stored as a transcript instead of a rule, and that is ordinary software design. Every agent product now has an "always allow" button. The question to ask your vendor is not whether it has one but what exactly it writes down when you press it, and where that ends up.

3. Databricks Ships Genie, an Autonomous Coworker With a Spending Cap

Databricks launched the new Genie on 11 November. It is an agent that takes long-running jobs by email, Slack or Teams, follows up when inputs are missing, and runs jobs on schedules or triggers such as a dipping metric. It works under the user's own identity, sees only what that user can see, and records every action. Admins set per-user budgets, spending caps and alerts. Databricks says Genie answered correctly in 91% of runs on a Turing-built benchmark, 1.6 times the better of two frontier agents it was tested against.

Hot take: The useful word in that announcement is "budget", not "autonomous". The data platforms have worked out that an agent you cannot put a spending limit on will not get past a CFO. Expect per-agent budgets to be a standard procurement checkbox by the middle of next year.

4. IBM and Microsoft Pool "6,000 Agents", Then Send Engineers

IBM and Microsoft launched Imagine Enterprise on 10 November. IBM Consulting brings more than 6,000 prebuilt agents and assets, Microsoft brings the cloud, data and security stack, and forward-deployed engineers from both companies come with it. It starts with financial services, insurance and retail. Coverage was quick to point out that the 6,000 figure counts assets as well as agents, and that no production results have been published yet.

Hot take: In August we wrote that OpenAI could not sell an agent without sending engineers. Now IBM and Microsoft have made the engineers part of the product. A catalogue of 6,000 items that needs a services team to install is a consulting engagement, and a smart one. Just do not confuse it with something a 20-person company can switch on.

5. NEAR AI Breach Reached 18 Agents on a Legacy Deployment Nobody Had Moved

NEAR AI disclosed that an attacker exploited a remote code execution flaw in the open-source SGLang inference engine on 8 November. The attacker reached 18 agents running on an older deployment outside the company's trusted execution environment and took their chat history, settings and logs. Two customers' cloud API keys were sitting in those logs and have been revoked. Account details for about 100 users of the already-discontinued Private Chat service were also downloaded.

Hot take: The secure architecture was not breached. The old one that was still running was. Every company now running agents has a legacy deployment like this, a pilot from the spring with real credentials and a memory full of real conversations. Find yours before someone else does.

6. 79% of Enterprises Have Agents in Production. 15% Can Show the P&L.

Genpact surveyed more than 2,000 executives at companies with at least $1 billion in revenue. 79% say they have agents in production, but only 20% use them broadly across functions, and 15% have fully tied AI investment to P&L outcomes. Just 49% of AI initiatives funded in the last two years delivered the expected value. One more number deserves more attention than it got: 92% of companies with agents in production kept their workforce the same size or grew it.

Hot take: "In production" has become the new "we have a pilot". What matters is the 92%: the replacement story is not appearing in the data, even among the largest adopters. Agents are being added to teams, not swapped in for them, and anyone planning headcount around the opposite is planning around a press release.

7. Rox Raises $100M at $1.3B to Sell Against Salesforce

Rox raised a $100M Series B at a $1.3B valuation, co-led by General Catalyst and March Capital, for sales agents that run on each customer's own data warehouse. The company reports more than 10x ARR growth in its first year and net revenue retention above 700%. The same day, Kindo raised $30M to manage and control enterprise agents.

Hot take: Read the two rounds together. One company raises to put more agents in front of customers, the other raises to keep agents on a leash, in the same week and in the same market. Sales remains the first job companies hand to agents, and 700% retention says customers keep giving them more of it. Most of the quoted pipeline figures are pipeline, not closed revenue, and Rox's own coverage says so.

8. Agents Get a Phone Book and a Proper Home on Kubernetes

At KubeCon North America, the Linux Foundation formally launched the Agent Name Service on 10 November. It is a DNS-based standard, originally built by GoDaddy, for verifying and discovering AI agents, backed by 11 organisations. Google donated Agent Substrate to the CNCF. It runs agents in sandboxes directly on Kubernetes, because, in Jaana Dogan's words, code that agents write is untrusted by default.

Hot take: Identity and sandboxing are moving from vendor features to public infrastructure, which is how a technology becomes boring and dependable. Be clear about what ANS does and does not do: a verified name tells you who an agent is, not what it is allowed to do. Story two this week was about the second problem, not the first.

9. Conductor's Cloud Goes Read-Only Today

Meta acquired Conductor, the tool for running coding agents in parallel, on 4 November and closed sign-ups the same day. Conductor Cloud goes read-only today, 13 November. Deletion of cloud workspaces and chats begins on 20 November. The local Mac app gets updates only until early 2027.

Hot take: Your agents' working history is now an asset, and this week showed it can disappear on someone else's schedule. If a tool holds months of your agents' context, the export path is part of the contract, not an afterthought. "We were acquired" is a perfectly normal reason for a vendor to give you seven days.

What We're Watching Next Week

• A fix date for Claude Code's "don't ask again". Built-in credential scanning was promised in a Hacker News thread. We want it in release notes.
• Imagine Enterprise's first named customer. A catalogue gets interesting once someone puts a production number next to it.
• Who adopts ANS first among the big agent platforms. Eleven supporters is a start. One hyperscaler resolving agent names through it would make it a standard.
• Conductor's deletion window. The 20 November start date has no published end date. Watch for one.

Bottom Line

Very little that went wrong this week was a model failure. A permission was saved word for word. An old deployment was left running with real keys in its logs. A workspace had an expiry date nobody had planned for. Meanwhile the products that shipped (Genie's budgets, Fable's Orchestrator role, ANS's verified names) were all attempts to make agents easier to account for. The industry is learning, in public and at some expense, that "don't ask again" is a decision, and someone has to own it.

Build With Agents You Can Account For

Geta.Team gives every AI employee its own identity, an inbox and phone number, and a persistent memory you can read. You decide what each one may run, and anything outside that list comes to you for approval in the chat. It is self-hosted by default, so your agents' history stays on your own infrastructure, under your control. Start with one AI employee for free at geta.team.