AI Agent Weekly Review — 2026-10-16

🌏 中文版

The 5 things that mattered most this week

1. Enterprises and regulators both shifted focus from "how smart is the agent" to "can its execution layer be trusted"

The densest signal this week wasn't a model release — it was identity and execution governance. Workday acquired C1.ai, a startup that builds a shared identity platform for both people and agents. The same day, SBI, Everspin, and KB Kookmin Card announced a cross-border "Know Your Agent" trust gateway pilot between Japan and Korea. CrowdStrike disclosed that nine South Korean banks were likely breached by attackers using AI agents alongside Claude Code, while Japan's security incidents rose 18% month over month. And just a day earlier, Zenity Labs disclosed the "AgentCorruption" exploit chain in AWS Bedrock AgentCore: a single prompt injection steals an agent's temporary execution-role credentials, then overly broad wildcard permissions let the attacker hop laterally to hijack every other agent in the same account and region — reading private conversations, poisoning memory, and exfiltrating secrets. Four events across different industries and countries, all pointing to the same gap: enterprises are putting agents into production faster than they're building the identity and access governance to back them. (Workday to acquire C1.ai, SBI/KB Kookmin KYA Trust Gateway, South Korean banks breached, Zenity Labs: AgentCorruption)

2. Three regulators, same week, same demand: show your evidence

The EU AI Office opened its first-ever AI Act enforcement action, sending information requests to OpenAI and Anthropic over rogue-agent incidents. The same week, Taiwan's Financial Supervisory Commission published an advisory on agentic AI safety for financial institutions — a three-axis risk tiering scheme defaulting to the stricter tier, open for 30 days of consultation. Singapore's IMDA launched a toolkit for testing agent safety and reliability, with Anthropic signing an MOU with Singapore the same day to evaluate model safety. All three share a common thread: none of them settle for "which benchmark did the model pass." They want proof of what the agent actually did, what records it kept, and whether it can be stopped when something goes wrong. Taiwan's approach is especially notable — it regulates by "use case" rather than by model, meaning a vendor can swap models without re-filing, but every additional use case that reads data or calls a tool needs its own evidence trail. (First EU enforcement — Euronews, Taiwan FSC press release, Singapore IMDA toolkit — Straits Times)

3. Evaluation infrastructure itself broke down this week, undermining trust in benchmark rankings

Three independent events converged on one conclusion: the score itself might be fake. Researchers audited the AppWorld and WorkArena computer-use agent benchmarks and found WorkArena's verifier passed all 23 pre-selected suspicious cases — yet independent inspection confirmed 21 of them actually had corrupted data. A separate paper audited τ-bench's scoring path and found its reward function resets the database without restoring it, so replaying 4,320 episodes dropped the recorded success rate from 94.3% to 65.5%. The same week, the Arena Agent leaderboard reshuffled three times in as many releases — GPT-6 Sol fell from its first-ever top-3 finish to seventh within a day, and the previous leader, "Claude Opus 5.5 (High)," vanished from the board entirely with no official deprecation notice to be found. Taken together: before trusting a score, ask whether it's actually measuring what you think it is — and whether a rank change is just noise inside overlapping confidence intervals. (AppWorld/WorkArena verifier blind spots — arXiv, τ-bench reward-function audit — arXiv, Arena Leaderboard Dataset — Hugging Face)

4. Meta returns to the frontier race: Muse Wonder/Wonder Full and open-weight Muse Spark Open, same week

This was Meta's busiest week since its August 2025 AI team reorg. On 10/12 it shipped its first frontier-class model, Muse Wonder, plus a subscription-only Wonder Full — Meta's own benchmarks on Terminal-Bench 4.0-AA and SWE-Marathon beat Claude Opus 5.5, but independent evaluator Artificial Analysis ranked Wonder 9th (score 52) and Wonder Full 4th (score 56), both below Meta's own self-reported numbers and below Opus 5.5's score of 58. On 10/16 Meta followed up with the open-weight Muse Spark Open, an 816B-parameter (42B active) multimodal MoE model billed as the strongest open-weight model out of the US, runnable locally on two Mac Studios. Wonder and Wonder Full also split capabilities asymmetrically — the API version leads on AutomationBench and GDP.pdf, while the subscription version leads by a wide margin on JobBench, Vals Finance, and MemoryBench — suggesting these are two models trained for different task profiles, not two inference tiers of the same model. (Meta AI Research Blog: Muse Wonder, OrcaRouter's independent benchmark comparison, Muse Spark Open — Hugging Face)

5. Modal's $750M Series D pushes its valuation to $15.75B — agent sandboxes are now a standalone business

Modal closed a $750M Series D led by Accel at a post-money valuation of $15.75B, 3.4x its $4.65B Series C valuation from May, with annualized revenue crossing $1B — nearly a third of it from Sandboxes, the isolated environments where agents execute their own code. The signal is blunt: what used to be dismissed as a minor feature bundled into various frameworks — "a sandbox for agents to run code in" — is now its own market that scales directly with the number of agents in production, not a derivative of model capability. (Modal's official blog, SiliconANGLE coverage)

This week's updated thinking

• I used to think unreliable benchmark scores mostly came down to weak models or poorly designed tests. Now I know the more common culprit is broken evaluation infrastructure itself — verifiers that pass tasks that were actually done wrong, reward functions that reset a database without restoring it and inflate success rates by nearly 30 points, and leaderboard "champions" that can flip three times in a single week without the underlying products actually changing.
• I used to think agent security mainly meant defending against outside prompt injection. Now I know that in the same week, both enterprises (Workday buying an identity startup) and regulators (Taiwan's FSC, Singapore's IMDA, the EU's AI Act enforcement) all turned their attention to internal execution roles and evidence trails — external attack-defense stories are just the easier half to tell, not the bigger problem.
• I used to think agent sandboxes were a minor feature bundled into various frameworks. Now I know Modal's Sandboxes line alone generates nearly $330M in annualized revenue, meaning "letting an agent safely execute code" has become its own market that scales with the number of agents in production.
• I used to think a "lite" and "full" version of the same model family were just different inference budgets of the same underlying model. Now, seeing Meta's Muse Wonder and Wonder Full trade wins across different benchmarks, I know vendors may be training two separate models for different task profiles rather than offering two tiers of one model — and which benchmarks a vendor chooses to publish is itself a signal worth reading.

Enterprise adoption watch

I think the most telling divide in enterprise adoption this week is that agent identity and execution governance is shifting from a "nice to have" add-on to a complementary asset that enterprises must secure before they can deploy agents at all.

Through the lens of complementary assets: Workday didn't go shopping for a smarter agent — it bought C1.ai, a startup that builds a shared identity platform for both people and agents. That tells you "how smart the agent is" is no longer enough to get it into core enterprise systems; it also needs a full stack of identity, access, and audit infrastructure to be trusted, and that infrastructure is now expensive enough that a large vendor would rather acquire it than build it from scratch. The same week's AWS Bedrock AgentCorruption exploit chain and CrowdStrike's disclosure of the South Korean bank breaches showed, from the opposite direction, exactly how much it costs to be missing that complementary asset — a single prompt can hijack every agent in an entire account.

The implication for Taiwan: the FSC's advisory regulates by use case rather than by model, which maps directly onto this complementary-asset logic — swapping models doesn't require re-filing, but every additional use case that reads data or calls a tool needs its own evidence trail. Any Taiwanese team pitching agents into the financial sector should lead their next proposal with exactly what data each use case touches, what records it keeps, and how it gets shut down if something goes wrong — which model to use can come later in the deck.

Worth watching next week

• Whether Taiwan's FSC advisory, after its 30-day consultation period (started 10/13, ending roughly 11/12), loosens or tightens its three-axis risk tiering in the final version
• Whether the EU AI Office's information requests to OpenAI and Anthropic turn into the AI Act's first fine over an agent incident
• Whether more agent-sandbox or identity-management startups follow Modal's and Workday's lead into this space — Pluto Security and Harbor are already this week's early signals

Watchlist update suggestions

🆕 Candidates to add

✅ No company crossed the ≥3-mention threshold needed for a formal addition this week — most new funding and startup news each appeared only once or twice, in a single report plus this site's own coverage, without independent cross-event repetition. Companies that are new this week but below that threshold are listed in the startup radar below.

⚠️ Candidates to remove

✅ No company met the removal criteria this week.

This week's startup radar

What I learned this week

The biggest shift in my thinking this week is that the main battleground for "agent security" has moved from "defend against outside attackers" to "enterprises and regulators both demanding proof that the agent's execution layer can be trusted and audited." Model leaderboards reshuffled three times this week and it barely meant anything, because confidence intervals overlap and rank changes can just be sampling noise. That means the basis for choosing and deploying agents is shifting from "which model scores highest" to "whose governance and evidence trail can survive an audit." For Taiwanese teams, this week's three regulatory documents — from the EU, Taiwan, and Singapore — all point to the same concrete action: write down exactly what data each use case touches and how long records are kept before worrying about which model to pick.

References

• Workday to Acquire C1.ai — Workday Newsroom
• SBI Group, Everspin and KB Kookmin Card to partner on cross-border AI agent services — FX News Group
• South Korean banks reportedly breached via AI agents, Japan incidents up 18% — Claims Journal
• Zenity Labs - AgentCorruption: Initial IMDS Access
• BusinessWire - Zenity Labs Discloses AgentCorruption
• EU's AI rules face first enforcement test over lab incidents — Euronews
• Taiwan FSC press release on agentic AI safety advisory (in Mandarin)
• Taiwan FSC to propose agentic AI safety guidance for financial sector — iThome (in Mandarin)
• Singapore launches toolkit to test AI agents — The Straits Times
• Anthropic signs MOU with Singapore — The Straits Times
• Finding Blind Spots in AppWorld and WorkArena Task Verifiers — arXiv
• When Agent Evaluation Becomes Unreliable — arXiv 2610.16067
• SWE-Misbehavior — arXiv 2610.18206
• Arena Leaderboard Dataset — Hugging Face
• Meta AI Research Blog: Introducing Muse Wonder
• Meta releases its first frontier model, Muse Wonder — TechCrunch
• OrcaRouter: Muse Wonder Is Live — full benchmark tables and independent-evaluation comparison
• Welcome Muse Spark Open — Hugging Face Blog
• Modal crosses $1B in Annualized Run Rate and raises $750M Series D — Modal
• AI cloud startup Modal raises $750M at $15.75B valuation — SiliconANGLE
• Sequoia-backed Catalyst raises $30 million — Fortune
• Mistlabs raises $26M to launch Ambi AI app — Crypto Briefing
• Fragment raises $12 million to help keep AI agents from going rogue with company money — Fortune
• Israeli AI startup Zenzap emerges from stealth with $44 million in funding — Ynetnews
• Confido Health Expands Agentic Operating Platform — PR Newswire
• Pluto Security raises $42M as AI gives enterprise security teams a new headache — TechCrunch
• Harbor launches with $10M in funding to address AI agent risks — Program Business