An agentic pentest tool drove the ConnectWise breach; ADK changes telemetry
Microsoft says a China-aligned group used an open-source agentic pentest framework to reach privileged cloud access in under three hours, NVIDIA released a 4B looped model, and Google ADK 2.13 changes its default telemetry.
Sunday’s theme is permissions: what a stolen app can do, what a default can quietly change, and who is judging your outputs.
1 · Top story
An agentic pentest framework drove the ConnectWise attack, Microsoft says
Microsoft attributes the ConnectWise Cloud Backup compromise to Storm-0940, a China-aligned group using ARTEX, an open-source framework that runs LLM agents through a whole intrusion. After the compromise it tried sign-ins to more than 2,250 tenants. In some environments the agents went past login: they queried Microsoft Graph, added application credentials and changed privileged roles.
The lesson is less about the AI and more about speed. A multi-tenant app with high privileges is now a thing that gets used within hours, so review service-principal permissions by application ID, not by name. Microsoft advises keeping the affected apps disabled and preserving evidence before deleting anything. It did not say how many organizations were actually compromised.
2 · Models & features
NVIDIA’s Dory is a 4B model that can loop longer when it needs to
Dory 1.0 is a looped, latent-recurrent model: 4B parameters, up to 256K tokens of context, released 16 October under the OpenMDW licence. It reuses its layers in a loop, and the card says you can change the loop count at inference without retraining. That makes compute a dial rather than a model-size choice.
If it holds up, one small model could serve both cheap routing and harder reasoning, with latency you set per request. NVIDIA’s benchmark table, run on its own harness, is the only evidence so far. It reports scores at 1, 2 and 4 loops (SWE-bench Verified 50.3, 59.5 and 61.8), recommends 2 loops by default and 4 for agentic tasks. Each extra loop normally adds its own KV cache; the card’s last_loop cache mode keeps memory at the one-loop size.
3 · Agents
Google ADK 2.13 moves default tracing to OpenTelemetry GenAI v2
ADK 2.13.0, released 22 October, makes OpenTelemetry GenAI v2 (otel_semconv_1_44) the default and removes the call_llm span. Set ADK_TELEMETRY_SCHEMA_VERSION_OPT_IN=otel_semconv_1_36 to keep the old schema. The release also promotes 12 experimental features to stable, adds barge-in for live audio and experimental MongoDB session and memory services, and claims up to 8x faster execution turns for string-model agents.
The telemetry switch is the one to read twice. Dashboards, alerts and cost reports keyed on call_llm will go quiet without an error. Pin the opt-in, upgrade on a branch, then migrate queries on your schedule.
4 · Research
Your LLM judge matters more than your prompting strategy
A new study ran nine prompting strategies, including chain-of-thought and role conditioning, through four open-weight judge models across 27 languages and 13 datasets, over a million scores in all. The judge model mattered more than the strategy, and effects sometimes reversed between judges. Stability dropped in low-resource languages, where averages hid it.
So a judge prompt tuned on English with one model isn’t evidence for another model or language. For multilingual products, validate the judge against human labels per language before trusting a dashboard. It’s a preprint, and I found no linked code.
5 · Architecture
Treat each agent task as an actor with a mailbox
In an InfoQ talk, Manju Rajashekhar argues production agents are distributed systems and fit the actor model. Everything is a message to one mailbox per task: chat input, tool results, cancellations. State has one owner and is written through as it changes, so crash recovery is just resumption. Failures are handled by supervisors with restart, retry or escalate policies, and waits become recorded state rather than blocked call stacks.
It’s a design lens, not a product, and he says no mainstream agent framework clearly implements it. But “what are the actors, what state does each own, who supervises whom” is a useful review question for any agent runtime.
Also worth knowing
🆕 New on the radar
- Vercel fx — an experimental, pre-1.0 coding agent in Zig, shipped as one 6.3 MiB binary that works as a CLI or an embeddable library (Vercel’s own size and cold-start claims); no licence is named in the write-up. Watch. Source
- Spark-X2.6-4B — a 4B Apache-2.0 on-device model with three thinking levels and a configurable 1M-token context; the card claims it matches some 9B models, with scores only in images and no stated release date. Watch. Source
🧰 Models & tools
- Amazon Polly generative engine — a drop-in upgrade, announced 22 October, with 14 new voices, Hindi and Finnish generally available, bidirectional streaming and no price change; speech marks aren’t available on generative voices. Source
- Pydantic AI 2.61.0 — adds structured citations on text parts and Kimi K3.1 Pro model names; read the compatibility notes, including a warning when provider thinking settings override
thinking. Source
🏢 Platforms & enterprise
- Claude on Google Cloud — an Anthropic-managed deployment option is now GA alongside the Google-managed one, at the same pricing; the difference is who is data processor, and the Google-managed option keeps VPC Service Controls, CMEK and U.S., EU and APAC data residency. Source
- Copilot in Microsoft Teams — @GitHub in a thread can now investigate a bug and open a pull request; the legacy GitHub app is retired on 16 November. Source
- Nutanix tie-ups — plans with NVIDIA, Supermicro and Netris for Vera CPU support, on-premises inference systems and GPU-cloud tenant isolation; Nutanix commits to no dates or pricing. Source
🔬 Research
- RIFT — a preprint on compressing the KV cache of speculative-decoding draft models, keeping over 98% of full-cache acceptance length with Qwen3.5-4B drafting for Qwen3.5-122B at an 8K budget; no code link yet. Source
Deadlines & deprecations
- 2026-11-16 — the legacy GitHub app in Microsoft Teams is retired; teams using it should install the consolidated GitHub app and reconnect their account. Source
Week in review
The five that mattered
- CERT-In on agents reaching live systems: the week’s first reminder that agent access is a security question.
- llm-d 1.0: distributed inference is getting a shared open stack.
- Vercel durable-harness: resumable agents are becoming a library feature.
- LiteLLM supply-chain compromise: your gateway is part of your attack surface.
- Brotli decoder bug: so is the decompressor in your HTTP client.
Threads: security led the week, from gateways to decoders, and today’s ConnectWise story adds attackers who use agents too. Durable, resumable execution keeps showing up too, and today’s actor talk is the same idea.
📈 Most discussed this week: guardrails. Google’s Data Agent Kit shows the split: a skill that asks the agent to stop is advice, an IAM deny condition is enforcement.
Decisions to revisit: which guardrails are enforced rather than advised, and which third-party apps hold permissions to change roles.
Sunday’s a good day to check one app’s permissions and then close the laptop.
Middle East, India & events · 1
- Jais 3 — MBZUAI’s Institute of Foundation Models and G42’s Inception42, with Cerebras, announced on 15 October six open Arabic language models from 900 million to 375 billion parameters, plus Jais Speech for Arabic dialects. Weights are on Hugging Face with vLLM and SGLang support; the licence isn’t named, and the benchmark gains, such as 56.4 to 79.6 at 7B, are the builders’ own. Source
Researched and drafted with AI, checked against the linked sources. How we use AI →