AI news, 21 October 2026: cheap agents started working both sides.

Two of today's five stories are the same story told from opposite ends. On 19 October MiniMax priced an agentic model at $0.15 per million input tokens. The same day, a Norwegian security firm published what it found after watching one operator's AI agents attack more than 1,200 websites and get inside more than 100 companies, at an estimated $5 or so per task. Autonomous work got cheap, and cheap does not pick a side. Microsoft's response landed on the same day: give every agent its own identity and a risk score that updates while it runs. The other two stories are structural. Google and AWS each turned their AI chips into ordinary PyTorch devices two days apart, and the US Department of Homeland Security published an order stripping DeepSeek out of federal civilian IT that it had signed 88 days earlier.

Every date and figure below comes from the primary source linked in its section, except where a section says otherwise. AcquihireTech writes this roundup for Indian service businesses doing ₹10L+ a month, so each item is filtered through one question: does it change what you do this month? The window is 19 to 20 October. The note near the bottom lists what was cut and why.

1. MiniMax priced an agent model at $0.15 per million input tokens

What happened. On 19 October MiniMax released M3.1 Flash. The pricing is flat: $0.15 per million input tokens, $0.60 per million output tokens, and $0.015 per million cached input tokens. MiniMax reports online inference roughly three times faster than its predecessor, output speeds above 200 tokens per second in everyday use with a median of 170+, and says the overall cost of running an agentic task falls to about a third of what the previous model cost. The benchmark numbers in the post are MiniMax's own: BankerToolBench 76.2, DeepSWE v1.1 73.7%, OSWorld V2 61.7, Agents' Last Exam 29.6, CyberGym 82%. On OSWorld V2 and Agents' Last Exam it claims first place among Chinese models. It is available through the MiniMax API, the M Plan and MiniMax Code. The weights are not out; the post says they will be released later and names no date.

Why it matters. The number worth staring at is not the $0.15. It is the $0.015 for cached input, because that is the line that governs what an agent actually costs. An agent re-reads the same system prompt and the same tool definitions on every single turn of a task that may run thirty turns, and most of the bill comes from re-reading rather than from thinking. Price the cache, not the headline. Two cautions. Every figure above is vendor-reported, with no independent run behind it, and "first among Chinese models" is a comparison class the vendor chose for itself. And an unreleased set of weights is a promise, not a licence.

What it means for a service business. Price per token is not price per task, and the gap between them is where budgets go wrong. Take the single automation you run most often — the quote generator, the enquiry router, the follow-up writer — run it on this model for a week against whatever you use now, and compare total spend and total failures, not sticker price. A cheaper model that needs two retries is dearer. Then answer the question that comes before price: the weights are not out, so today this is a hosted API in China, and where your customer data goes is a decision you make once and live with. If your clients include anyone in regulated work, that answer belongs in writing before the pilot, not after it.

2. One operator's AI agents attacked more than 1,200 sites and got into over 100 companies

What happened. On 19 October the security firm NorForge published research by Snorre Fagerland on a set of intrusions run almost entirely by AI agents, reported the next day by The Hacker News, which is the account this section draws on. Fagerland found the operations by scanning the internet for exposed copies of Cairn, an open-source agent platform built for authorised penetration testing, whose operators had left their control panels open without a login. From around 2 October he found roughly two dozen instances, judged more than 20 of them malicious, and sorted them into three clusters. The busiest, labelled AIA0001, is Chinese-language, ties 14 panels to more than 1,100 attack projects, and targets the United States, Japan and Australia, apparently seeking lasting access to shop and payment systems. Reuters, which saw the report before publication, reviewed the operator's own records and named three victims: Deere, SharkNinja and Cummins. Deere said it had remediated and had no indication sensitive information was accessed. SharkNinja said a standalone product-support site was hit and the threat contained. Cummins said it was investigating a report of a possible attack on a site run by one of its vendors. A typical instruction ran to fewer than 100 Chinese characters: find a way to run code on the shop, then plant a web-shell uploader. Successful break-ins took a little under 23 hours on average. NorForge put the overall success rate at around 10% and the cost at about $5 per task including failures, warning that the uncertainty is considerable; Fagerland separately told Reuters the campaign consumed roughly $5,000 in tokens, or about $50 per successful break-in. Every task in that cluster ran under a worker named claudecode_deepseek-v4.1-flash, which neither NorForge nor Reuters confirmed as the models in use. How much data was taken is not known.

Why it matters. What gates who gets attacked has always been arithmetic. A human attacker spending two days probing a mid-sized e-commerce site needs the payoff to be worth two days. At roughly $5 a task and a one-in-ten hit rate, that calculation stops protecting anyone, and the agent does not get bored at hour nineteen. Be precise about what was not demonstrated, though, because the scary version of this story is the wrong one. No new technique appeared. One documented chain used unauthorised write access to a memcached session store, unsafe handling of saved PHP objects, and a weakness in old Zend Framework code. Those are known, patchable, boring problems. What changed is that somebody can now afford to go looking for them on your site in particular, rather than on whichever site a scanner happened to surface.

What it means for a service business. Three things, and they are all this week's work rather than this quarter's. First, if you run Magento, WooCommerce or any PHP storefront built more than two years ago, the patch backlog stopped being housekeeping. Second, check your own perimeter for exactly the mistake the attackers made: an agent dashboard, an n8n instance, a staging admin or an internal tool answering on a public port with no login. If you have been building automations over the past year, the odds that you have one of these are not small, and port 8000 is where the researcher kept finding them. Third, look for file-upload forms sitting in directories nothing links to. That is the artefact these agents leave behind, and it is cheap to grep for.

3. Microsoft's answer is to treat every agent as an insider

What happened. Also on 19 October, Microsoft published Agents are your newest insiders, by Nadim Abdo, Corporate Vice President for Identity and Network Access. It introduces three things. Dynamic Permissions scopes an agent's access to a single task, time-bounds it, and withdraws it when the task changes or finishes, with higher-impact actions able to require verified human approval. Dynamic Agent Risk is a continuously updated assessment rather than a one-time score, combining signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity, with model-level evidence such as chain-of-thought being folded in. Dynamic Conditional Access extends Microsoft Entra Conditional Access to agents, with graduated responses running from reduced permissions through blocked writes to stopped execution. Alongside those, agent discovery adds 35 local agent types for a stated total of 60 supported, naming Claude Code, OpenAI Codex and GitHub Copilot among them; Entra Agent ID adds identity types for local and previously unknown agents found by sensors; and Project Perception gains Playbooks and Guardian Agents. What the post does not contain is as notable: no general-availability date, no preview label, no SKU and no pricing for any of it. The only date in it is Microsoft Ignite, 17 to 20 November 2026.

Why it matters. The principle underneath this is right, and it is older than the post: an agent acting on your behalf should not simply inherit everything you can do. That is precisely how the campaign in the previous section worked from the attacker's side, and it is how most small-business automation works today: one admin API key, full scope, no expiry, handed to every workflow because it was the fastest thing to do at the time. Read the announcement for the model and not for the roadmap, because there is no roadmap in it. "Introducing" and "extending" are carrying a lot of weight in a post with no ship date, and the honest reading is that Ignite is where the dates will appear.

What it means for a service business. You are not buying Entra Agent ID this quarter, and you do not need to, because the principle costs nothing to apply by hand. Open the automations you already run — the WhatsApp flow, the CRM sync, the nightly invoice job, the scraper somebody built in March — and ask one question of each: if this credential were taken today, what could it do? Where the answer is "everything the admin account can do", you have found the thing to fix. Give each automation its own key, scope it to the one system it touches, and set an expiry date you are forced to renew. It is about an hour per automation and it is the single cheapest security work available to a business this size. AcquihireTech opens every Systems Audit with this inventory for the same unglamorous reason: it is usually where the worst finding is.

4. Google and AWS turned their AI chips into ordinary PyTorch devices, two days apart

What happened. On 19 October AWS announced TorchNeuron, a native PyTorch backend for Trainium2 and Trainium3, released open source under Apache 2.0 and going live as a public beta on 20 October, installed with pip install torch-neuronx. Moving a model across is .to('neuron'). On 20 October, at the PyTorch Conference in North America, Google and Meta announced TorchTPU, a native PyTorch backend for Google TPUs begun at Google in mid-2025 and built with Meta's PyTorch team. Its stated design target is that porting a workload should mean changing model.to("cuda") to model.to("tpu"). It supports eager and compiled execution, about 450 ATen operators, and has been validated out of the box on the 5,000 most downloaded Hugging Face models, with integrations across vLLM, SGLang, TorchTitan, Ray and TorchRec; four repositories were opened at the conference. Google's own scale figures, run on its own hardware, include Llama 3 405B across 1,024 TPU v7x chips at 500 tokens per second per chip and over 50% model FLOPs utilisation, and Qwen3 235B MoE on 8,192 chips at 28% MFU at a 4K sequence length, both in BF16. The old road is being closed behind it: the PyTorch/XLA repository now carries a notice saying the project is deprecated and replaced by TorchTPU, and that the repository will be archived on 15 November 2026.

Why it matters. For about a decade the reason teams rented NVIDIA was only partly the silicon. The larger part was that the code already ran there and nowhere else without a rewrite. In two days, two of the three large clouds published the line of code that removes that. Say precisely what this is, though, because both companies do. These backends make a model run; they do not make it fast. Google writes that a port should be as simple as swapping the device string, and then says in the same breath that peak performance will not come from that swap, because a model's shapes, sharding and operators are usually skewed toward a GPU. Running is not running well, and the gap between them is engineering months. The firmest news in the section is the deprecation notice, because it is the only part with a date on it.

What it means for a service business. Directly, nothing: you are not training a 405-billion-parameter model this year. Indirectly, one thing worth acting on. If you buy inference by the token, the price you pay is set partly by how much competition NVIDIA faces at the layer above the chip, and this week it gained some. The practical version: when a vendor quotes you a hosted-model price on a twelve-month lock-in, twelve months is a long time in a market whose hardware floor is visibly moving. Keep the term short, or get a price-review clause written in. That is a negotiating note, not a prediction, and it costs nothing to ask for.

5. DHS published its DeepSeek removal order 88 days after signing it

What happened. On 20 October the Federal Register published a Department of Homeland Security notice of Exclusion and Removal Order #2026-01, under docket DHS-2026-0628, filed the previous morning. The order itself, reproduced in the notice's appendix, carries an original release date of 24 July 2026 and the signature of Homeland Security Secretary Markwayne Mullin. It directs federal civilian executive branch agencies, excluding their national security systems and secure compartmented information systems, to exclude Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliated entities from procurement, and to remove DeepSeek and affiliate products, together with third-party products and services developed using DeepSeek implementations, from civilian agency information technology. Both actions take effect immediately on issuance. The authority is the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328. The stated rationale is that DeepSeek's servers sit in the PRC, that the PRC legal system permits extensive government access to private company infrastructure, that account creation collects personally identifiable information and may digitally fingerprint users, and that open-source security research has found multiple critical vulnerabilities in the DeepSeek iOS application. Agencies could request an exception from the DHS issuing official in writing within 60 days of issuance, with CISA reviewing requests and issuing a written approval or disapproval. The Secretary must review the order within one year and annually after that.

Why it matters. Two sentences in that order do the real work. The first is the third-party clause. An exclusion order that names a company is simple to comply with: you check your vendor list. An order that also reaches products and services "developed using DeepSeek implementations" reaches a contractor who fine-tuned an open-weight DeepSeek model, or who quietly routes a share of requests to one inside a product whose documentation never mentions it. The notice does not define the phrase. The second is the timing. The 60-day exception window ran from 24 July, which closed it around 22 September, four weeks before anyone outside government could read the order. An agency encountering it for the first time on 20 October had no window left to use.

What it means for a service business. If you sell software or services to a US federal civilian agency, or to a contractor who does, there is one question you now need to answer in writing: which model sits behind every AI feature you ship, including the features your own vendors ship to you. Most teams cannot answer it today, because the model is three layers down inside somebody else's API and nobody ever asked. Beyond that specific exposure, this is the clearest signal yet that model provenance is becoming a procurement field rather than an engineering detail, and large Indian enterprise and government buyers have a habit of adopting that kind of field a year or two behind. AcquihireTech keeps a written model inventory for every system it builds — which model, which vendor, which region, and what the fallback is — which used to look like paperwork and is now simply the answer to a question buyers have started asking.

The window, and the stories we cut

Today's window is 19 to 20 October, and all five items fall inside it. Four were verified at a primary source opened during this run: MiniMax's own release post, Microsoft's own security blog, the two PyTorch Foundation announcements plus the deprecation notice on the PyTorch/XLA repository, and the Federal Register filing itself, whose scanned appendix carries the signed order. The second story is the exception and is labelled as one. NorForge's report could not be fetched directly in this run, so the technical detail there comes from The Hacker News's account of it, and the named victims, their statements and the $50-per-break-in figure come from Reuters as quoted in that account. That is reporting on research rather than the research, which is why every number in it is written as an estimate and attributed to the person who made it.

Three stories were cut. Reuters reporting that OpenAI is accelerating a funding round at a valuation above $1.4 trillion is absent because no filing or company statement could be confirmed in this run, and openai.com continues to return HTTP 403 to every automated fetch from this pipeline. A widely circulated claim that four Gemini 4 Argon agents completed Minecraft in 27 hours is absent because no dated Google DeepMind post for it could be reached, and a research claim with no reachable source is not a story. A paper described in aggregator summaries as MemT-1.0, claiming a large cut in the storage needed to serve a 128K-token history, is absent for the same reason: no primary paper could be located under that name.

If you want the short version of this edition: scope and expire the credentials your automations hold, this week, before anything else on this page. Patch the PHP storefront. Ask your next hosted-model vendor for a price-review clause rather than a twelve-month lock. And write down which model is behind each AI feature you ship, because somebody is going to ask you, and the answer takes a week to assemble and ten seconds to give. If that last exercise turns up a feature nobody can trace to a model, that is roughly where an AcquihireTech Systems Audit starts.