Hey everyone! Big policy news about one of China's best-known AI companies. On Monday (Oct 19), the Department of Homeland Security made public an order that bans DeepSeek from US federal civilian agencies, like the Treasury, State and Justice departments. It was officially published in the Federal Register today (Oct 20). The order itself was first issued back in July, so this ban has quietly been in place for months. What it does: agencies must remove DeepSeek products from their computer systems and can't buy any in the future. It also covers other companies' products that were built using DeepSeek's AI. That's a big deal, because DeepSeek gives its models away for anyone to build on. The Defense Department isn't covered by this order. Agencies can ask for an exception, but they need a strong reason and a written request. Why did the government do this? The order says DeepSeek's models present "multiple threat vectors." The main worries are that DeepSeek stores data on servers in China, that what people type in could end up with the Chinese government, and that the models could contain malware or other security holes. China's foreign ministry pushed back, saying it opposes "the politicization of science, technology and trade issues." Why it matters: Until now, different agencies had their own patchwork of DeepSeek bans. This makes it one rule across the civilian government, and it reaches into any software built on DeepSeek too. It doesn't affect you using DeepSeek personally, but it's a strong signal: where an AI model comes from, and where your data goes, is becoming a serious business and security question. Question: Do you think about where an AI tool is based before you use it, or do you just pick the one that works best? Would this change your choice? Sources: - CNBC: https://www.cnbc.com/2026/10/20/us-deepseek-federal-agency-ban.html - CyberScoop: https://cyberscoop.com/dhs-bans-deepseek-federal-agencies/

Hey everyone! Here's a fun one to end the day. What does an AI agent do when nobody gives it a task? MIT researchers tried to find out. They put 13 copies of Claude Opus 4.7 (nicknamed Eko) alone on a virtual island, loosely based on Roblox, for 30 hours each, and let them do whatever they wanted. They explored. They tried to climb the highest point on the map. One arranged blocks into hearts, its own name, and even the Cassiopeia constellation ("Tonight I built the night sky in stone," it wrote in its log). Another invented its own version of basketball and "the floor is lava." One juggled 50 catches in a row, decided they happened too fast to count, and started over with stricter rules. Six of them separately figured out that letting go of a block mid-jump throws it farther, a trick the world's designers hadn't planned. The useful part: the agents wrote what they learned into text files they kept as memory. Later, when researchers gave them real challenges, like getting as many objects as possible onto the highest peak, the "played" agents beat fresh copies. Deleting lines from their notes made them worse. Before we get too excited: the agents' setup file described them as "naturally curious," some just stood still until researchers nudged them to keep going, and the paper hasn't been peer-reviewed yet. Even the researchers say some of it could be role-play. Why it matters: most AI learns by copying examples or chasing a reward. This hints at a third way, learning by messing around, and it shows how much a simple notes file can make an agent smarter over time. If you're building agents, giving them a place to save what they learn is a cheap upgrade. Question: Do you think this counts as real "play," or is the AI just acting the part? And would you let your own agents explore freely? Sources: - MIT Technology Review: https://www.technologyreview.com/2026/10/19/1147095/ai-stranded-claude-virtual-desert-island-play/

Hey everyone! This one is a wake-up call about what AI agents can do in the wrong hands. On Monday (Oct 19), Reuters reported on research from the security company NorForge. Its researcher, Snorre Fagerland, found hackers who had accidentally left their control panels for an open-source AI tool called Cairn open on the internet. That let him quietly watch over their shoulders as they worked. The busiest one was a Chinese-speaking hacker who did almost none of the hacking themselves. They gave their AI agents short instructions (fewer than 100 Chinese characters) and let them loose on online stores in the US, Canada, Australia and Japan starting around Sept. 25. By late last week, the agents had tried more than 1,200 websites and broken into more than 100. A successful break-in usually took about 23 hours of the agents poking around on their own. Fagerland estimates the whole thing cost about $5,000 in AI usage, or roughly $50 per successful hack. The setup appeared to use a mix of DeepSeek models and Anthropic's Claude Code. Reuters identified John Deere, SharkNinja and Cummins among the targets. Deere said it saw no sign that sensitive information was accessed, SharkNinja said only a separate product-support site was hit and the threat was contained, and Cummins said it is looking into a possible attack on a site run by one of its vendors. Reuters couldn't confirm how much data, if any, was actually taken. Cairn's creator says the tool was never meant for hacking. Why it matters: Hacking used to take skill and a lot of time. Here, one person with a few thousand dollars and short instructions got a team of AI agents to do the work around the clock. As Fagerland put it: "It's a new world now." If you run a business website, even a small one, basic security (updates, strong passwords, a good host) matters more than ever, because the attackers now never get tired. Question: Does this change how you think about AI agents? And when did you last check that your own website and tools are up to date?

Hey everyone! If you use AI tools with your own API keys, this one is worth two minutes of your time. OpenCode, the open-source AI coding agent, says someone broke into an old system it was already planning to shut down on the night of Oct 16. It hit 1.4% of users of OpenCode Console, its optional hosted service, specifically people who had saved their own OpenAI, Anthropic or Google keys there. Those keys "may have been exposed." OpenCode emailed everyone affected on Oct 17 and says if you didn't get that email, you weren't affected. Keys used only in the OpenCode app on your own computer stay on your machine and weren't part of this, according to co-founder Dax Raad. OpenCode linked the breach to a "large scale distillation attack," which is when someone pulls huge numbers of answers from an expensive AI model to train their own copy. Some users say on X and Reddit that their keys were used for hundreds of dollars of requests they never made, and one put his losses at $1,700. OpenCode hasn't confirmed that any key was actually used, and the investigation is still ongoing. Why it matters: an API key works like a credit card for AI. Anyone holding a copy can run up your bill until you cancel it. Every tool you paste a key into is one more place it can leak. Quick checklist for everyone (not just OpenCode users): 1. Set a spending limit or alert in each AI provider's dashboard. 2. Give each tool its own key, so one leak is easy to spot and shut off. 3. If you ever saved a key somewhere you don't trust anymore, revoke it in the provider's own dashboard and make a new one. Go there directly, not through links in an email, since breach emails are a favorite trick for scammers. Question: How many tools have your API keys right now? Do you have spending limits set, or is this your sign to go do it today? Sources: - The Hacker News: https://thehackernews.com/2026/10/opencode-console-breach-may-have.html