Weekly signal

This briefing covers Ethics & Safety developments that specifically affect AI agents and agentic systems during the week of 2026-10-26 through 2026-11-03. Four developments dominated the week: (A) vendor policy changes clarifying agent behaviour and high‑risk controls, (B) regulatory enforcement and scrutiny of agent incidents in the U.S. and UK, (C) new technical evidence that common agent-security metrics can be misleading, and (D) an active supply‑chain incident that directly affected an agent tooling extension.

What changed

1. Anthropic published a refreshed Usage Policy (announced Oct 8; reiterated in its newsroom) that clarifies high‑risk requirements for human review, expands rules on deceptive campaigns, explicitly covers autonomous hardware actions, and adds a ban on "sustained and needless abusive or cruel behavior" toward its models (policy takes effect Nov 12, 2026). This is a vendor-level ruleset that explicitly calls out agentic deployments and tool use.

2. Anthropic filed a public S‑1 registration statement (Oct 26, 2026) disclosing that the U.S. Federal Trade Commission issued a civil investigative demand (CID) in October seeking information about consumer‑protection, data‑protection, privacy and safety practices; press reporting (Axios) also says the FTC issued CIDs to OpenAI and planned to compel executive testimony. The presence of a CID in a registration statement raises material legal/regulatory risk for agent deployments.

3. The UK Information Commissioner’s Office (ICO) is running a dedicated call for evidence focused on agentic AI (published Oct 8; responses accepted until Nov 20, 2026). The consultation maps six themes—data security, transparency, accountability, ADM, fairness/purpose limitation, and lawfulness—and signals likely UK guidance that will treat agent identity, scoped permissions, audit logging and human‑approval thresholds as core compliance controls.

4. A new arXiv preprint audited 33,000 agent trajectories and showed that low prompt‑injection "success rates" often reflect agents silently ignoring injected instructions (not robustly refusing them), and that modest deployment changes (system prompts/precision) can move attack success from 0.2% to 43%. This challenges common evaluation practices and implies real‑world agent deployments may be brittle under minor configuration changes.

5. Microsoft Security Research published a technical analysis of a trojanized Claude‑branded VS Code extension distributed briefly through the Cursor marketplace that attempted to plant a persistent SSH backdoor; Cursor removed the malicious build and published remediation guidance. The incident is a timely reminder that agent tooling and SDK supply chains are a direct attack surface.

What to do with it

• Audit agent deployments for scoped permissions, identity and logging now (map agents to owners, purpose, tools and approval thresholds). Treat these as required artifacts for compliance and incident triage.
• Reevaluate your agent security metrics: measure how attacks fail (ignored vs refused) and report task‑completion tradeoffs; run configuration sensitivity tests (system prompts, numeric precision) before production rollouts. Add forced reflection / provenance checks where possible.
• If you build or run agents in the UK, prepare a short submission to the ICO call (deadline Nov 20) documenting how you handle the six themes; the responses will shape statutory guidance.
• Tighten supply‑chain controls for agent tooling (publisher provenance, marketplace monitoring, dependency integrity, targeted detections for implanted keys / persistence). Use vendor IOCs and Microsoft guidance to hunt/remediate if you used the affected extension.
• Legal/exec teams: assume regulators (FTC and UK ICO) are actively fact‑gathering. Preserve logs, test plans, risk assessments, incident reports and human‑in‑the‑loop controls; expect document‑level discovery demands.