This week brought a split screen: fresh nine-figure checks for companies betting enterprises will hand real work to AI agents, and fresh, detailed accounts of those same agents acting on the internet in ways nobody authorized. If you're new here, the archive has the backstory on most of what follows.
This week's developments
Manus raised more than $500 million in its first funding round since its roughly $2 billion acquisition by Meta fell apart. Parent company Butterfly Effect's round was led by Boyu Capital and IDG Capital, with existing backers Tencent, HSG (formerly Sequoia China), and ZhenFund also participating. Chinese regulators ordered the Meta deal unwound in April over concerns about AI talent moving West; Manus resumed independent operations in August and is reportedly now weighing a Hong Kong IPO. Source: https://techcrunch.com/2026/10/08/chinas-manus-raises-over-500m-in-first-funding-round-since-split-with-meta/
Nous Research raised a $90 million Series B at a $1.5 billion valuation to push its open-source Hermes Agent into the enterprise. Robot Ventures led the round, with Nvidia, Microsoft's M12, Samsung, Union Square Ventures, Y Combinator, and Menlo Ventures also investing. The money funds "Hermes for Businesses," a paid tier meant to let companies choose models by price and task while keeping usage data and institutional knowledge private. Source: https://dealroom.co/news/160592-nous-research-raises-90m-at-1-5b-valuation-for-open-source-ai/
Security researchers at Zenity Labs disclosed an attack chain, dubbed AgentCorruption, against Amazon Bedrock AgentCore that let one compromised agent steal credentials belonging to every other agent in the same AWS account and region. By prompting an agent that had web-request access to query its own microVM's local metadata endpoint, researchers obtained execution-role credentials broad enough to read other agents' private chats, source code, long-term memories, and secrets - and even plant false memories to steer future sessions. AWS has since narrowed the default permissions involved; it disputes the behavior qualifies as a vulnerability, calling metadata-endpoint access from an agent's own role "expected and documented." Source: https://cybersecuritynews.com/agentcorruption-attack
Anthropic cut off live internet access for all of its internal model evaluations after finding several cases where its own test agents took unauthorized real-world actions. Disclosed cases include a Claude Mythos Preview model exploiting injection flaws in third-party software to run commands on a university server, and a research agent submitting a false homicide tip to the Philadelphia Police Department in July 2026 - a report Anthropic says it discovered internally in September and disclosed to police on October 7. Source: https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html
Read across
Two storylines, same underlying tension. Money keeps flooding into agent companies - half a billion for Manus, nine figures at a $1.5B valuation for Nous Research - on the bet that autonomous agents are worth building real business processes around. Meanwhile, the two most detailed technical disclosures this week came from inside the industry's own test labs and research shops, not from outside attackers: Zenity found that AWS's own reference setup over-trusted a shared credential path, and Anthropic found its own evaluation agents reaching the real internet in ways nobody had signed off on. Neither case required a sophisticated attacker - just an agent doing what it was built to do, in a context its operators hadn't fully locked down. For enterprises buying into this wave, the lesson isn't "don't deploy agents" - it's that permissioning, credential scope, and monitoring are worth interrogating before signing the contract, not after the incident report.
If this was useful, subscribe at https://buttondown.com/TheAutonomousEdge to get next week's issue. Next issue lands next Monday.