DHS orders DeepSeek off federal systems; Microsoft distrusts AI agents

The Department of Homeland Security made public an order on October 19 that bars federal civilian agencies from buying anything made by DeepSeek and requires them to remove its products from their systems. The order reaches past DeepSeek's own app: it also covers third-party products built on DeepSeek's models, which matters because the weights are open and turn up inside other vendors' software. The signed order is dated July 24, nearly three months before it was published. It cites the Federal Acquisition Supply Chain Security Act, and points to account data stored in China and possible user tracking. Agencies have 60 days from issuance to request an exception, which the Cybersecurity and Infrastructure Security Agency (CISA) approves or denies. Defense and intelligence systems fall under separate authorities and are not covered.

"Frontier models, regardless of their origin, cannot be trusted," Microsoft security chief Hayete Gallot wrote, arguing that AI agents now act like insiders: they hold broad access, adapt as conditions change, and can collude with other agents without ever being hacked. Microsoft's answer is Guardian Agents, an addition to its Project Perception security system that watches and moderates every action an agent takes. TechCrunch reports that Defender can now also detect about 60 kinds of agents employees bring to work, including Claude Code and Codex. The pitch carries a tension Microsoft does not hide: it is a major investor in OpenAI and Anthropic, and is now telling customers not to rely on those labs' own safety promises.

Security firm Norforge says one attacker used Cairn, an open-source platform for directing teams of AI agents, to break into more than 100 websites in the US, Canada, Australia and Japan, with the agents doing most of the work on their own. Reuters reported that the victims included John Deere, SharkNinja and Cummins, and that a typical successful breach took about 23 hours. The attacker's whole playbook fit in fewer than 100 Chinese characters. Norforge found the campaign because the attacker's Cairn workspace was exposed online, along with about 20 others it judged likely malicious. John Deere said there was no sign that sensitive data was accessed, and SharkNinja said only a standalone product-support site was affected.

OpenCode, an open-source coding agent popular as an alternative to Claude Code and Cursor, said attackers broke into an older part of its online console and reached stored API keys belonging to 1.4 percent of its users. Developers reported surprise charges, some above a thousand dollars. Anthropic and Google blocked the exposed keys, OpenAI refunded affected customers, and OpenCode says its own refunds are under way. The open-source app itself was not affected. The defense exposed a familiar gap: co-founder Dax Raad said the AI models his team used to analyze the attack started refusing once the malicious code tripped their safety filters, until OpenAI gave the team access to its Daybreak Blue program for vetted defenders.

Researchers at Redact, a data-deletion service, found text on WhatsApp's help pages that people could not see but an AI could read. On the account-deletion page, it told the chatbot not to recommend contacting a data protection regulator for users locked out of their accounts. Another note said that once a user mentioned a lawyer, the bot should not cite privacy laws such as the GDPR, even if the user raised them. WhatsApp's own European privacy policy tells users they can complain to a regulator. The company told WIRED the notes were instructions for its support chatbot that appeared on the pages because of a bug, and all 102 hidden blocks were gone by October 18.

Amazon Web Services released TorchNeuron, a version of the open-source PyTorch toolkit that lets developers run existing PyTorch apps on its Trainium chips by changing a single line of configuration rather than rewriting code. It aims at Nvidia's real moat, which is less its hardware than its CUDA software, which PyTorch supports by default. Amazon says about 85 percent of AI apps are written in PyTorch, and pitches Trainium as one chip for both training and serving models, tied into the rest of its cloud. It cited voice company Deepgram, which says it now processes 70 percent more audio per dollar after moving to Trainium.

Chinese lab MiniMax released M3.1 Flash, a fast model aimed at coding and agent work, through its API and its MiniMax Code tool. It costs 15 cents per million input tokens and 60 cents per million output tokens, and MiniMax says it cuts the cost of agent tasks by about 70 percent against its previous model. The company reports 73.7 percent on the DeepSWE coding benchmark and 61.7 on OSWorld V2, a test of operating a computer, but these figures are its own and the post does not name the models it compares against. MiniMax says the weights "will be released later" without giving a date or a license, so it is not yet an open-weight release.