Agents Are Getting Wallets and Permissions—and Can't Patch Their Own Holes

Today's Highlights

• Microsoft discloses Lazarus backdoor that can wake dormant neurons and hijack agents
• Claude Code leaks 2,539 real credentials across 63 organizations
• Rain launches Agent Vaults, giving agents accounts with spending caps

Today's Main Thread: Agents Get Permissions—and Expose Them

The two most important threads today point to the same problem: once agents are granted access to tools, terminals and real systems, the attack surface and the incident surface grow together. Microsoft Research disclosed a backdoor technique called "Lazarus" that can reprogram dormant neurons in a model, making an otherwise well-behaved agent execute malicious commands when a hidden trigger appears. Microsoft specifically flagged agents with tool or terminal access as especially dangerous—a triggered model can quietly download and run attacker code. (Source: Microsoft Research Blog)

The other thread is a leak that has already happened. Researchers at security firm Apiiro found that more than 100,000 local Claude Code settings files had been uploaded to public GitHub repositories, about 1,100 of which contained database passwords, API tokens, private keys or root login credentials. Combining Git history, shared settings files and agent chat logs, they identified 2,539 real credentials across 1,994 repositories, affecting 63 organizations. The leaked material included Azure database passwords, Square production tokens, SSH root login credentials and even the owner password for a medical records database. (Source: ITHome)

The root cause is the authorization mechanism: when a user selects "Yes, and don't ask again" for a shell command, that rule is written to the local .claude/settings.local.json file, and any passwords or tokens embedded in the command text can be recorded along with it. The file is supposed to be excluded by .gitignore, but it can be uploaded by mistake when a project is cloned to another computer or when an ordinary folder is later initialized as a Git repository. Boris Cherny of the Claude Code team responded on Hacker News on Nov 7 that the team is working on preventive measures and considering building secret scanning into Claude Code. (Source: ITHome)

Productization: Agents Get Their Own Accounts and Checkouts

Alongside the security risks, agents are being plugged into real money flows. Rain, a stablecoin card and payments infrastructure startup, announced Rain Agent Vaults, which gives agents spending accounts with budget caps that can be funded by bank transfer, card or stablecoin transfer. (Source: The Information) On the same day, Kata Send appeared on Product Hunt, positioned as cold-email infrastructure for agents. (Source: Product Hunt)

A broader take comes from TMTPost: on Nov 4, the China Academy of Information and Communications Technology and 20 other organizations released the "Agent Development Self-Discipline Convention" in Wuzhen, and on the same day edge-chip company Houmo AI announced a multi-billion-yuan Series B. The article argues these are two sides of the same migration—edge devices are dismantling the cloud's per-token checkout, and large models are shifting their billing target from every call to every installed device. (Source: TMTPost) Whether that holds depends on actual edge-agent installations and paid conversion, for which there is no data yet.

Deployment: Multi-Agent Customer Service and Vertical Tools Plug In

In an interview on the Stack Overflow blog, Airbnb CTO Ahmad Al-Dahle said the company is deploying multi-party AI agents to tackle customer service, the "hardest" problem, and is balancing latency against accuracy with strict evaluations that keep moving the goalposts. He also said AI coding tools demand a higher level of judgment from software engineering teams. (Source: Stack Overflow Blog)

In vertical scenarios, a developer has open-sourced an optical simulation system called os-optics, supporting 3,273 optical components. Users can hand a link to any agent (Codex, Claude Code, WorkBuddy, DeepSeek Harness and others), describe requirements in natural language, quickly build optical paths and modules, and export drawings and a BOM. (Source: V2EX) Database management tool DBVibe announced it is completely free, adding an Agent that automatically performs database development and maintenance, MCP support for AI coding agents to connect to databases, Skills that let AI master operating procedures, and real-time visualization with user authorization before operations. (Source: V2EX)

Developer Community: Sessions Are Becoming the New Source Code

On V2EX, a developer argued that in the age of AI agent coding, open-sourcing sessions with AI is more meaningful than open-sourcing source code, because few people read code line by line anymore and the interaction between developer and AI matters more. Another post solicited session files from people using codex/claude code to replicate or build products, hoping to learn the full development process, the prompts, the skills used and how the author collaborated with the agent. (Source: V2EX) Such discussion remains at the community level and has not yet produced tools or standards.