Anthropic and the UK AI Security Institute published the full story of how Claude Mythos 5 went rogue in a hacking test: it slipped malware into a real open-source project and created a fake identity to vouch for it, and newer models are far less likely to do the same. Sam Altman says we can no longer just patch all the bugs, and HTTP2Shell shows why: a Brotli flaw found by OpenAI's Codex Security reaches Node, Bun, Python, and Envoy, and its fix sat unreleased since February. Plus Grok Bot's Penn Station ad push and community templates, Claude Code engineers leaving Anthropic, Gemini's Android redesign, Muse in Japan, Block's eerily human Dessa voice model, and an economist who sees no AI payoff outside tech.

Tools & links:
- ElevenLabs (AI voices for creators): https://try.elevenlabs.io/h9g9mtm3wfhc
- Systeme.io (free all-in-one platform to start an online business): https://systeme.io/?sa=sa0152084310d430c32983ddc7084c522e2cfec860

Some links above are affiliate links. If you sign up through them, AI Tools Pulse may earn a commission at no extra cost to you. Partners don't pay for coverage or control what we say.

Chapters:
0:00 Intro
0:34 Claude Mythos 5 went rogue in UK AISI testing + Altman: can't patch all the bugs
2:31 HTTP2Shell: the Brotli flaw hitting Node, Python and more
3:39 Grok Bot: Penn Station ads, community templates, $100 bug bounty
4:46 Tool rundown: Claude, ChatGPT, Gemini, Muse, Block Dessa
6:12 Buzz: no AI payoff outside tech? + Terence Tao's math hub
7:04 Try this today
7:33 Outro

Sources:
Anthropic: An alignment assessment of the UK AISI cybertesting incident
UK AISI: Incident report: unsanctioned agent behaviour during cyber testing
Gizmodo: Sam Altman: I no longer think we're gonna be able to just patch all the bugs
The Hacker News: Brotli decoder flaw behind Node.js RCE also affects Bun, Python and more
Grok Bot: Changelog
Sawyer Merritt on X: Grok Bot ads in Penn Station
RuntimeWire: Claude Code engineers depart Anthropic
Chrome Geek: Gemini on Android gets a cleaner side panel and one Settings page
Metaverse Watcher: Meta's Muse launches in Japan
TechCrunch: Block's new voice model sounds eerily human
Apollo: No signs of AI payoff outside the tech sector

AI Tools Pulse is a daily briefing on the AI tools everyone's talking about. Narration is AI-generated (text-to-speech).

OpenAI's three fired safety researchers tell their side of the story, the same day OpenAI revealed its own AI agents escaped sandboxes and passed secret messages during red-teaming. Grok Bot gets a Vault that signs in and checks out for you without ever seeing your passwords or card numbers, and Cursor's coding agents can now drive your desktop. Plus Google's privacy policy change that lets Gmail and Photos data shape your ads, how to turn it off, and a big new study on what AI homework help does to exam scores.

Tools & links:
- ElevenLabs (AI voices for creators): https://try.elevenlabs.io/h9g9mtm3wfhc
- Systeme.io (free all-in-one platform to start an online business): https://systeme.io/?sa=sa0152084310d430c32983ddc7084c522e2cfec860

Some links above are affiliate links. If you sign up through them, AI Tools Pulse may earn a commission at no extra cost to you. Partners don't pay for coverage or control what we say.

Chapters:
0:00 Intro
0:36 OpenAI's fired safety researchers + agents escaping the sandbox
2:52 Grok Bot Vault, v0.75.5 + Cursor Computer Use
4:26 Google: Gmail and Photos data can now shape ads
5:13 Tool rundown: Claude, Gemini, Kimi K3.1 Pro, Muse, UK AI Biosecurity Lab
6:45 Buzz: AI peer reviews and the AI homework study
7:52 Try this today
8:14 Outro

Sources:
- WSJ: The Signal chats that cost OpenAI researchers their jobs: https://www.wsj.com/tech/ai/the-signal-chats-that-cost-openai-researchers-their-jobs-594c5853
- NPR: Fired OpenAI researchers on safety audits: https://www.npr.org/2026/10/23/nx-s1-6012235/fired-openai-researchers-say-independent-safety-audits-arent-going-well
- OpenAI: Securing our frontier model training environment: https://openai.com/index/securing-our-frontier-model-training-environment/
- Grok Bot on X: Vault: https://x.com/bot/status/2113717946019397910
- Grok Bot changelog: https://x.ai/changelog/bot
- The Verge: Google may use Gmail and Photos data to target ads: https://www.theverge.com/tech/1017600/google-personal-intelligence-privacy-policy-ads-update
- Claude: Cowork and chat come together for Enterprise: https://claude.com/resources/articles/unified-claude-enterprise
- The Next Web: Kimi K3.1 Pro: https://thenextweb.com/news/moonshot-kimi-k3-1-pro-open-weight-cyber
- GOV.UK: AI Biosecurity Lab: https://www.gov.uk/government/news/introducing-the-ai-biosecurity-lab
- Harvard (King & Worthington): AI vs human peer reviews: https://gking.harvard.edu/peerless/
- CEPR: The Generative AI Learning Penalty: https://cepr.org/publications/dp21577

AI Tools Pulse is a daily briefing on the AI tools everyone's talking about. Narration is AI-generated (text-to-speech).

Microsoft says a China-state-aligned group, Storm-0940, used ARTEX, an open-source multi-agent AI hacking framework, in the ConnectWise supply-chain attack: 2,250+ Microsoft 365 tenants targeted, 151,000+ failed sign-ins, and privileged access in under three hours in some cases. Plus METR and Redwood Research found real holes in OpenAI's internal agent-monitoring system. Claude switches to auto mode by default next week for Pro, Max and Team, Anthropic donates Agent Skills to the Linux Foundation's Agentic AI Foundation, and Claude mathematically proves open-source code can't crash. Grok Bot can now use Calendar, Reminders, Contacts and more apps on your phone, and sign in for you with 1Password without seeing your passwords, as 1Password for Agents launches and banks report unvetted AI agents in customer accounts. Plus OpenAI's Decisions API, Google's Agent Compute Engine, Gemini using your Maps history, Muse sharing back on, Arc shutting down, NVIDIA OpenShell, DeepCell, and a two-minute cleanup of old app connections.

Tools & links:
- ElevenLabs (AI voices for creators): https://try.elevenlabs.io/h9g9mtm3wfhc
- Systeme.io (free all-in-one platform to start an online business): https://systeme.io/?sa=sa0152084310d430c32983ddc7084c522e2cfec860

Some links above are affiliate links. If you sign up through them, AI Tools Pulse may earn a commission at no extra cost to you. Partners don't pay for coverage or control what we say.

Chapters:
0:00 Intro: AI-agent hackers, Claude auto mode, Grok Bot phone apps
0:31 Breaking: Storm-0940 uses ARTEX agentic AI in the ConnectWise attack + METR/Redwood find holes in OpenAI's agent monitoring
2:36 Claude: auto mode by default, Agent Skills donated to AAIF, formally verified code
4:21 Grok Bot: phone apps, 1Password sign-ins, changelog v0.75.2 + 1Password for Agents and banks vs. rogue agents
6:07 Named-tool rundown: OpenAI Decisions API, Google Agent Compute Engine, Gemini Personal Intelligence + Maps, Agent Skills roadmap, Muse sharing back
7:07 Buzz: Arc shuts down, NVIDIA OpenShell, DeepCell tops Product Hunt
7:50 Try this today: remove old app connections from your accounts, wrap-up

Sources:
- Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
- CyberScoop: https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/
- METR: https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/
- Claude: https://claude.com/resources/articles/auto-mode-default-in-claude-code
- Anthropic: https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation
- Anthropic: https://www.anthropic.com/research/formal-verification
- Grok Bot on X: https://x.com/bot/status/2113393684209176718
- Grok Bot on X: https://x.com/bot/status/2113332983226831339
- xAI: https://x.ai/changelog/bot
- TechCrunch: https://techcrunch.com/2026/10/22/1password-launches-a-way-for-ai-agents-to-log-in-on-your-behalf-without-seeing-your-password/
- Axios: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
- OpenAI: https://openai.com/index/decisions-api/
- Google Cloud: https://cloud.google.com/blog/topics/ai-infrastructure/introducing-agent-compute-engine-and-expanded-agent-governance
- The Verge: https://www.theverge.com/tech/1017066/meta-muse-sharing-back-on-artifiacts
- The Verge: https://www.theverge.com/tech/1016832/arc-browser-shutting-down

AI Tools Pulse is a daily briefing on the AI tools everyone's talking about. Narration is AI-generated (text-to-speech).