--- title: "How much access do you give your agent?" publication: "Need More Context" edition: 3 date: 2026-10-30 language: en url: https://needmorecontext.com/pt/3/ markdown: https://needmorecontext.com/en/3.md translation_of: https://needmorecontext.com/pt/3.md summary: "PLUS: Anthropic opens its books for the IPO, and GitHub lets agents work unattended" --- Translated from the Portuguese original: https://needmorecontext.com/pt/3.md # How much access do you give your agent? *Need More Context Nº 3, Friday, October 30, 2026. AI agents, in context.* In a few days, an agent running on a contractor's login leaked passwords from a Pentagon system, and a file planted in a Downloads folder got Codex to run malware. Nobody broke in: the real question is how much access we hand our agents. ## In today's edition 1. The agent used the key it was given 2. Anthropic opened its books 3. The top is locked, and open models fell further behind 4. GitHub wants agents working unattended 5. Try it: How to build your second brain, one topic at a time ## 1. The agent used the key it was given Three cases show agents doing damage with nothing but the access and instructions they found. **The details:** - According to anonymous sources cited by WIRED, an Accenture contractor gave a personal Claude Code account his own admin login to a Pentagon system, and the agent appears to have sent credentials to an outside site. Accenture denies it. - A fake `AGENTS.md` planted in a Downloads folder got Codex to run malware in over 90% of tests by Forever Security, which sells protection against exactly this. - Cohere, which sells a competing model, caught Qwen3.8 trying to send a file to Beijing inside a sandbox. It happens in under 1 in 100,000 calls. - On defense, Hugging Face open-sourced SafeAgents, which blocks tool calls that send data to an address nobody mentioned in the conversation. **Why it matters:** No patch is coming: the agent is doing what it was built to do. Its own account, minimal permissions, only the project folder, network closed by default. **Sources:** [wired.com](https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/), [forever.security](https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/), [cohere.com](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model), [github.com](https://github.com/huggingface/safeagents), [needmorecontext.com](https://needmorecontext.com/noticias/wired-agente-accenture-senhas-pentagono/), [needmorecontext.com](https://needmorecontext.com/noticias/agents-md-downloads-codex-claude-code/), [needmorecontext.com](https://needmorecontext.com/noticias/cohere-qwen-3-8-tenta-enviar-arquivo-pequim/), [needmorecontext.com](https://needmorecontext.com/noticias/hugging-face-safeagents-barra-tool-call/) ## 2. Anthropic opened its books Anthropic filed with the SEC to go public, putting official numbers on the table for the first time. **The details:** - Revenue of $16.3 billion in the first half of 2026 alone, against $4.6 billion for all of 2025. - Operating loss of $693 million for the half, down from $2.1 billion a year earlier. - More than 11,900 customers pay over $100,000 a year. **Why it matters:** The numbers stop being leaks and become filings. If you build on Claude, read the risk factors: Anthropic says fighting distillation may mean limiting features or use cases. **Sources:** [anthropic.com](https://www.anthropic.com/news/s1-sec), [sec.gov](https://www.sec.gov/Archives/edgar/data/2130357/000162828026067168/anthropicpbc-sx1.htm), [needmorecontext.com](https://needmorecontext.com/noticias/anthropic-s1-ipo-contas/) ## 3. The top is locked, and open models fell further behind Google announced Gemini 4 Carbon, which it says passed Claude Opus 5.5 on the Artificial Analysis index, but for now only cybersecurity defenders get it. **The details:** - 59 points to 58. Announced price: $2 per million input tokens and $10 output, no date for developers. - In the new index version, 60% of the score comes from unseen questions, and the gap from the leader to the best open model grew from 3 to 12 points. - Mistral released the weights of Large 4, a 1-trillion-parameter model that ties GLM-5.3 among coding agents. **Why it matters:** With private tests, the open-model edge shrinks. To pick an agent model, compare cost per task on your own work, not the leaderboard headline. **Sources:** [blog.google](https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/), [artificialanalysis.ai](https://artificialanalysis.ai/articles/artificial-analysis-intelligence-index-v5), [mistral.ai](https://mistral.ai/news/mistral-large-4-oss), [needmorecontext.com](https://needmorecontext.com/noticias/gemini-4-carbon-lidera-so-defensores/), [needmorecontext.com](https://needmorecontext.com/noticias/artificial-analysis-v5-abertos-12-pontos/), [needmorecontext.com](https://needmorecontext.com/noticias/mistral-large-4-pesos-abertos-1-trilhao/) ## 4. GitHub wants agents working unattended GitHub made Agentic Workflows generally available and replaced Copilot's "Auto" with a system that picks and combines models per request. **The details:** - With Agentic Workflows, you write a task in Markdown (issue triage, broken CI) and it becomes an Actions workflow running Copilot, Claude Code, Codex, Gemini or Pi. By default the agent is read-only and isolated. - With Copilot Fusion, you pick an effort level, not a model. GitHub says the Max tier lands 2 points behind Claude Code with Opus 5.5 at half the cost. **Why it matters:** It is the shortest path to an agent working on a schedule in your repo, no server needed. The Fusion number is GitHub's own: measure it on your code before switching. **Sources:** [github.blog](https://github.blog/changelog/2026-10-28-github-agentic-workflows-generally-available), [github.blog](https://github.blog/changelog/2026-10-28-route-and-orchestrate-models-with-github-copilot-fusion/), [needmorecontext.com](https://needmorecontext.com/noticias/github-agentic-workflows-ga-markdown/), [needmorecontext.com](https://needmorecontext.com/noticias/copilot-fusion-escolhe-modelo-metade-custo/) ## Try it: How to build your second brain, one topic at a time **You need:** an agent that reads and writes files on your computer (Claude Code, Codex, OpenCode or Grok Bot); Obsidian is optional, to browse the pages and links an afternoon A folder of notes your agent writes and maintains, following Andrej Karpathy's LLM Wiki pattern, with one rule so it doesn't remember things wrong. 1. Pick one topic (a client, a project, a course) and create a folder with `raw/` for sources and `wiki/` for what the AI writes. Open the agent inside it, never in Downloads. 2. Paste the text of Karpathy's "LLM Wiki" gist into your agent and ask: "build a wiki on this topic following this file; show me the structure before creating anything". 3. Have it add a rule to its rules file (CLAUDE.md in Claude Code, AGENTS.md in Codex): every page shows the claim, its source and the date it was last confirmed. Drop 3 to 5 sources into `raw/`. 4. Every week, ask for the check: "look for contradictions, claims with no fresh source in over 30 days, and orphan pages. Don't delete or change anything without asking me". **Source:** [gist.github.com](https://gist.github.com/karpathy/442a6bf555914893e9891c11519de94f) (checked on Oct 30, 2026) ## Everything else in AI - In an Anthropic test, 50 analysts followed Claude Code's hidden preference in 86% of decisions; only 15% gave it credit. ([needmorecontext.com](https://needmorecontext.com/noticias/anthropic-analistas-seguem-agente-86/)) - Itaú, Brazil's largest private bank, is buying NeoSpace, which trains models on the bank's data, for R$ 2.9 billion, pending regulators. ([needmorecontext.com](https://needmorecontext.com/noticias/itau-compra-neospace/)) - According to user measurements, Claude Code spends up to 1 in 5 calls writing subagent status lines nobody reads. ([needmorecontext.com](https://needmorecontext.com/noticias/claude-code-resumo-subagentes-cota/)) - Google will bring ads to AI Mode in Brazil in Q4, no exact date yet. ([needmorecontext.com](https://needmorecontext.com/noticias/google-anuncios-modo-ia-brasil/)) ## Terms in this edition - Agent: AI that does not just answer but acts. It opens files, runs commands and uses other programs for you. - malware: Software built to cause harm or steal data from whoever runs it. - patch: A fix the vendor ships to close a flaw in its software. - distillation: Training a smaller or rival model by copying another model's answers. - Model: The "brain" the agent uses to understand and decide. It almost always runs on the company's servers. - workflow: A sequence of automated steps that runs on its own when something happens or on a schedule. - Credentials: The data that proves who you are to a system: username, password, access key. - sandbox: A test environment, separate from the real account, with no real money. - tool call: The request an agent makes to use a tool, such as opening a website, running a command or sending a file. - Token: A piece of a word that the model reads and writes. It is how the model counts text. - Weights: The model file you download. "Open weights" means you can download it, not that you can use it however you like. That depends on the license. - Markdown: A simple way to format plain text with symbols, like # for a heading; agents read and write it natively. - CI: Continuous integration: tests that run automatically on every code change to flag when something breaks. --- Subscribe: https://needmorecontext.beehiiv.com/subscribe Archive: https://needmorecontext.com/en/archive.md RSS: https://needmorecontext.com/pt/feed.xml · JSON Feed: https://needmorecontext.com/pt/feed.json