AI Agents are not only starting to work for people but are also changing the nature of cyber attacks, government procurement, and hardware competition.
On October 20, 2026, three AI-related news stories stand out.
The first reveals real-world corporate cyber intrusions; the second involves US government restrictions on AI supply chains; the third highlights how, as AI Agents autonomously run extended tasks, hardware bottlenecks extend beyond GPUs.
1. Hackers Use AI Agents to Breach Over 100 Websites, 1,200+ Attacks Executed with Minimal Human Input?
On October 19, Reuters exclusively reported that cybersecurity researchers at NorForge discovered hackers extensively using AI Agents to attack corporate websites.
Researcher Snorre Fagerland examined multiple exposed Cairn control panels online. Cairn is an open-source system capable of coordinating multiple AI Agents to perform tasks, also usable for penetration testing.
The problem is that some users are not conducting authorized security tests but are exploiting it to breach real companies.
According to Reuters, a hacker using Chinese commands had AI Agents attempt intrusions on more than 1,200 websites, successfully breaching over 100.
Reuters independently verified some victim companies from operational logs, including agricultural machinery maker Deere, home appliance company SharkNinja, and engine manufacturer Cummins.
However, a site being breached does not confirm that all companies had sensitive data stolen.
Reuters stated that the extent of unauthorized data leaks remains uncertain. Some companies reported taking corrective measures or detected no sensitive data access.
The most striking aspect is not the number of attacks but the cost
Researchers observed that hacker instructions to AI Agents were likely very brief, yet the systems spent hours autonomously identifying site vulnerabilities, attempting methods, and reporting results.
They estimate the token cost of the AI models used in this wave of attacks to be around $5,000.
This estimate is based on observations and not independently verified actual bills.
Still, it reveals a significant shift: activities that previously required substantial human effort for vulnerability hunting and exploitation may now be run continuously by a handful of operators managing multiple AI Agents.
What should typical enterprises do?
If you run e-commerce sites, membership systems, or maintain client websites, it's worth double-checking:
- That websites, plugins, and extensions are regularly updated and known vulnerabilities patched.
- That backends, testing environments, and management interfaces are not unnecessarily exposed to public networks.
- Whether abnormal logins, intense requests, suspicious file uploads, and unexpected admin activities can be detected.
This does not mean every site is currently being breached by AI.
Rather, as attackers can persistently try attacks at lower cost, businesses can no longer rely on the assumption that "small sites won't be targeted."
2. US Orders Federal Agencies to Remove DeepSeek—Ban Extends Beyond Apps to Some Third-Party Services
On October 19, the US Department of Homeland Security (DHS) publicly issued an order requiring US federal civilian administrative agencies to exclude and remove specific DeepSeek technologies.
The order has two main points.
First, federal civilian agencies are prohibited from procuring information technology products and services developed by DeepSeek and its affiliates.
Second, agencies must remove DeepSeek-related products from their information systems, including third-party products and services developed using DeepSeek implementations.
This order is based on the 2018 US Federal Acquisition Supply Chain Security Act.
Reuters reports DHS is concerned about multiple potential risks posed by DeepSeek, including the possibility that sensitive information might be transferred to China and that the models may have other security vulnerabilities.
These are risk assessments made by the US government and do not mean all DeepSeek models have been confirmed to leak data.
As of the notice's release, the public text did not list specific third-party affected products or a unified removal deadline.
Why is the ban not just on a single chat app this time?
Previous AI tool restrictions often involved blocking employee installation of a specific app or forbidding pasting company data into external chatbots.
But AI models may now be embedded behind other software.
For example, a company may purchase a customer service platform, document management tool, or website service that appears to use the vendor's own interface but in fact connects to yet another AI model underneath.
Therefore, businesses can't simply ask whether they use the DeepSeek app but must understand what models suppliers are actually using, how they are deployed, and through which data pathways.
Should Taiwan and general users disable DeepSeek?
This US order applies specifically to certain federal civilian government systems and procurement, not a global ban on individual DeepSeek users.
General users in Taiwan are not automatically subject to the same restrictions due to this US directive.
However, businesses involved in US federal government projects or offering AI model–included software services should review contracts, system components, and their applicable scope carefully.
For general users, the reasonable approach is to evaluate AI tools based on data sensitivity rather than judging safety solely by the model’s country of origin.
3. Nvidia Vera CPU Achieves Up to Double Task Throughput in Early Tests Running AI Agents, AI Hardware Competition No Longer Only About GPUs
When talking about AI chips, Nvidia’s GPUs usually come to mind first.
However, as AI Agents execute programs, operate tools, and handle numerous background tasks over extended periods, the CPU’s role is becoming increasingly important.
Reuters reported on October 19 that AI cloud computing company Modal plans to start using Nvidia’s newly released Vera CPU to support AI Agent computing environments.
Modal previously used Intel and AMD processors and will now integrate Nvidia Vera into its hardware lineup for the first time.
Why is Modal switching CPUs?
Modal said early tests show that Vera achieves up to twice the task throughput of comparable x86 systems under heavy simultaneous AI Agent workloads.
It’s important to note:
Doubling throughput does not mean every single task per user runs twice as fast.
Throughput refers to how much work the entire system completes in a given time.
For instance, if one machine runs many AI Agents concurrently, some executing code, handling files, or using tools, it requires CPU resources.
If the hardware can handle more concurrent tasks, cloud platforms can process more work with the same or fewer resources.
However, Modal’s findings represent early internal tests and are not independent benchmarks applying across all workloads or use cases.
Modal also did not announce phasing out Intel or AMD processors.
The company plans a hybrid setup, allocating tasks to the most appropriate hardware, and intends to test competitors’ new processors in the future.
What does this mean for average AI users?
Ordinary users don’t need to rush to replace their computers based on this news.
The bigger point is whether AI service providers can run more Agent tasks simultaneously, reduce wait times, and lower computation costs for completing tasks.
If this technology maintains advantages after official deployment, cloud AI Agent service efficiency could improve.
But actual price changes and speed-ups for individual tasks still require validation with live operational data.
What do today’s three news items collectively indicate?
AI Agents are entering a new phase.
They can run tasks autonomously over long periods, prompting cloud platforms to rethink the roles of CPUs and GPUs and enabling hackers to find website vulnerabilities continuously with less human effort.
As AI models become deeply integrated into corporate software and government systems, users increasingly need to understand the technology supply chain rather than judging based on the product’s brand alone.
For most individuals, there is no urgent need to switch AI tools or buy new hardware today.
But if you are responsible for corporate websites, AI service procurement, or Agent deployment, prioritize checking these three things: whether systems are properly secured, the origin of underlying models, and whether claimed performance gains truly apply to your workload.
As AI becomes more autonomous, security, supply chain transparency, and performance verification will become essential considerations, not just optional add-ons.
