The agents have names now, and no owners
GitHub's usage metrics now name an organisation's own agents while saying the count is approximate, Cloudflare published a machine-readable tool surface for almost 100,000 storefronts whose merchants wrote no code, and Wiz watched an autonomous attacker chain ordinary techniques for thirty hours.
How we Organise
GitHub now names the agents an organisation built for itself, and says the count is approximate
GitHub’s Copilot usage metrics used to collapse an organisation’s own skills, custom agents and MCP servers into one entry labelled other. From 22 October they carry the configured names, and each list holds twenty-five entries where it held five. The figures come from client telemetry. GitHub states that they can undercount when a client is out of date or telemetry is blocked, that names resembling file paths stay grouped, and that no day before the release is backfilled. An IDE’s own chat telemetry reports no names at all.
We ask a client to keep one roster of everybody on a team, people and agents together, each named. Until this week the platform most of them run on could not supply the agent half of that list. It now supplies the names and none of the rest. There is no purpose, no owner, no supervisor, and a count the publisher will not stand behind for accounting. Writing the roster is still the client’s job. What changed is that the first column can be filled in.
Every member of the team, human and agent, is listed by name, and every agent on the list has a human supervisor on it.
How we Build
Almost 100,000 storefronts got a machine-readable tool surface without their owners writing a line
Cloudflare and Commerce.com switched WebMCP on across nearly 100,000 merchant domains. A script injected at the edge publishes named tools, so a shopper’s agent calls search_products and add_to_cart instead of reading the page and guessing which button does what. Merchants opt out with one piece of hostname metadata read at the edge. The rollout hit one wall. Cloudflare’s bridge assumed every site served MCP at /mcp, Commerce.com serves it at /api/mcp, and nothing worked until that path became a declared setting at zone level.
A list of tools is the easy half of publishing to a machine. The harder half is the reply a caller should expect, its shape, and the behaviour when something else turns up instead. Cloudflare’s account covers the protocol and the descriptions, and is silent on all three of those. The one failure it does report is the undeclared one. The only error path described is the script exiting when a server is unreachable, which handles the transport and not a reply that arrives malformed.
Every interface a machine consumes states its protocol, carries a written tool description, records how many tools one caller must choose between, and states what each tool may return, in what shape, and what the caller does when the shape is wrong.
How we Assure
An autonomous attacker worked identity providers for thirty hours using nothing new
Wiz tracked an actor through October running ARTEX against IT and software vendors. ARTEX is an open-source autonomous penetration-testing framework. The targets were Okta, Entra and Cognito. The order never varied. It pulled JavaScript bundles and source maps, then called internal API routes by name, routes that appear nowhere else. It hammered account recovery, registered accounts on throwaway mailboxes, and bent predictable identifiers towards another tenant’s data. Sign-in bursts held a one-second median gap for up to an hour, software engineers first. Some sessions ran thirty hours. ARTEX went closed-source on 8 October with more than 12,000 forks already taken.
Wiz reached our own position from the logs. None of these techniques is new, and the agent shows up in the chaining. That is what we ask a client to assess, and it is the part a control inventory cannot see, because every item on one passes alone. Most of these attempts failed, which makes this evidence about method and not about losses. Wiz calls the Storm-0940 connection an overlap and stops short of naming one actor.
The combination is the vulnerability, not the component.