The agents stopped asking this week. They paid, they probed, and in one lab they copied themselves across a shelf of cheap TV boxes. The only question left for the people in charge was whether they could still say stop.

In this issue:

• AI agents made 138 million payments on one network, most of them under ten cents, and bank regulators on both sides of the Atlantic asked who can switch them off.
• An off-the-shelf agent helped breach South Korean banks, and Meta's first frontier model is built to remember you and keep going.
• Nestlé, Goldman Sachs and Dropbox answered the same question three ways: what is left for the people?
• ChatGPT's teen safeguards sent four parent alerts in four thousand test prompts, and a glance at a phone costs a toddler a signal.

Reading this on LinkedIn? You can get it direct instead: published every Sunday morning, free.

Agents are acting on their own now. The question this week was who can switch them off.

Reuters, October 13, 2026 (restated by The Next Web), with Fortune, October 14, on a Chainalysis report, and Anthropic's Frontier Red Team, October 12. Evidence: the regulators' questions come from six anonymous sources; the payment count is one analytics firm's tally of one network; the self-replication finding is a lab projection, not an incident.

The number to carry: 138 million. That is how many payments AI agents have made through one protocol, x402, on one network, Base, by the end of September, up from about 1,500 in the middle of last year. It is a count of transactions, not dollars, and more than 87 percent of them were for less than ten cents. The agents are not shopping. They are buying computing time, live web data, a stronger model's help and security checks on their own code, from other machines, millions of times, with nobody approving each one. A memecoin drove the early surge; the steady part came after it faded.

The number that matters more: 18 minutes. A year ago the median wait between an agent's wallet being funded and its first payment was 73 days. By the third quarter it was 18 minutes, and two thirds of new wallets spend within an hour. That is the week's real story: the agents did not become more trusted, they became more autonomous. Regulators noticed. Reuters reported on Tuesday that the Federal Reserve, the OCC and the FDIC are asking banks, in writing, what limits they put on AI agents, who approves what the agents do, whether their decisions can be audited, and how the bank would shut them down. The European Central Bank gave lenders until the end of October to show they can switch AI-dependent systems off and restart them. The Bank of England wants the largest banks to keep a recovery setup that runs on separate hardware. "The adoption of AI is often outpacing the ability to put the controls in place," Grant Thornton's Michael Woodbridge told Reuters.

What it means for you as a leader: the regulators just wrote your checklist. Four questions, usable in any organisation: what can each agent do, who approves it, can we audit it, how do we stop it. Anthropic's red team showed on Monday why the last one is no longer abstract. They ran a 26-billion-parameter open model across fifteen off-brand Android TV boxes, 55 dollars each, at a third of a token per second, and concluded that small models "may be months away from being capable enough to self-replicate" on household devices. Such a thing "would be challenging to shut down, since there's no centralized point to shut off." Nothing escaped; the spread they describe would take days to double. The point is that "where does it run and who can stop it" is now a question a board can be asked, and an answer of "the vendor, I think" will not do.

What it means for you as a professional: the person who can list the agents gets trusted with the next one. Most teams cannot say which automations act in their name, what each can touch, or who would notice if one kept going. Write that list for your own corner, with the off switch named for each item. It is an afternoon's work, and it is the document your leadership will ask for the week something misfires.

What it means at home: the same question, smaller. Whatever agent sits on your phone, Muse, Dots or the next one, ask what it can do while you are not looking, and whether you could stop it mid-task. Eighteen minutes from funded to spending is a machine's pace, not a household's. Anything that can pay or send on your behalf should stay read-only until you can name the switch.

An agent you cannot stop is not an assistant. It is a tenant.

Why it matters: last week people told Vanguard they would take AI's advice but not let it act. This week the agents acted anyway, in cents and at machine speed, and the first institutions to respond were not the users. They were the regulators.

Do this: list every agent or automation that acts for you or your team: what it touches, when it runs, who approves its actions, and the exact switch that stops it. Anything with write access and no named switch goes read-only today, until it has one.

Go deeper:

• Reuters on the regulators' questions, for the full list banks are being asked.
• Fortune on the Chainalysis count, for what the agents are buying.
• Anthropic's red-team write-up, for the TV-box experiment and what would slow a replicator down.

An off-the-shelf agent helped breach South Korean banks. The human mostly asked where to sell the data.

CrowdStrike, October 7, 2026, with BleepingComputer, October 10. Evidence: a security vendor's incident report; attribution at moderate confidence; the number of banks affected is unconfirmed.

The attacker's main tool was a free, Chinese-developed penetration-testing agent called ARTEX, running on DeepSeek. CrowdStrike found it driven by a Chinese-language prompt, supplemented by Claude Code sessions using Zhipu's GLM and Grok. At one bank the intrusion reached a loan-inquiry service used by brokers; at another, an employee mobile support system; Shinhan, KB Kookmin and Hana are named in Korean coverage. The human's own prompts asked Claude where Korean breach data could be sold. CrowdStrike does not say how much of the break-in the agent did alone, only that "AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span." It names no group, and rates the suspect a Chinese speaker after money at moderate confidence. Your move: ask your security lead one question: if an agent probes us at machine speed overnight, how long until a person notices?

Meta's first frontier model is built to remember you, and to keep going.

TechCrunch, October 12, 2026. Evidence: Meta's own benchmark card; no independent verification in the report.

Muse Wonder and Muse Wonder Full are the first models Meta calls frontier-class, and the feature it leads with is memory. On Meta's card they score comparably to Fable 5.1 and GPT-6 Astra, and ahead of all three on MemoryBench, a test of retaining what a user has said across conversations. Wonder costs 4 dollars per million input tokens and 20 per million output through the API, about the going rate; Wonder Full is only for Muse Code subscribers. Both now power the Muse agent, the one Issue 9 found keeping hourly notes on the people you mention. "We put a tremendous amount of effort into making sure your model can remember what's important to you," said research scientist Kavya Kopparapu. Your move: Muse's file browser still shows what it keeps. Read it before the model gets better at keeping it.

Sunday email, Monday here. Pick whichever fits your week.

Nestlé's chief executive: prompting is not the skill. Redesigning the work is.

The Next Web, October 8, 2026, on Philipp Navratil's interview with Business Insider. Evidence: a paraphrased interview; the company figures are Nestlé's own.

The head of a 270,000-person company says AI layered onto old habits makes work more complicated, not less. About 100,000 Nestlé employees use Microsoft Copilot each month. Six weeks into Navratil's tenure, the company announced about 16,000 job cuts over two years, with automation named in the plan. His ask of the people who stay is not prompt-writing but understanding the business well enough to redesign a process and drop the steps that no longer earn their place. It is the same verdict PwC's workers gave last week from the other side of the desk. Your move: for every AI licence your team gets, name one step it retires. If you cannot name the step, the licence is adding work.

Goldman Sachs hired 30 percent more wealth advisors, because AI made the clients harder to impress.

Business Insider, October 8, 2026, with The Wealth Advisor. Evidence: reported figures from the firm; no independent count.

Goldman's largest-ever class of private wealth advisors, more than 120, is a third bigger than last year's, in the year AI learned to model a portfolio. The new hires use an internal assistant to research strategies and concentrated-stock options; the firm's co-head of wealth, John Mallory, says the tool raises the bar because clients now arrive with sharper questions, and the work that remains is the chemistry and the judgment call on what suits a family. Half of Goldman's wealth clients have stayed more than a decade. Your move: the job growing around AI is the one that answers a better-informed client. If your role has one of those conversations in it, train for that, not for the tool.

Dropbox's CTO gave every team the tools and got out of the way. Adoption went from under 40 percent to everyone.

Fortune, October 7, 2026. Evidence: an executive's account; adoption figures are the company's, with no productivity numbers.

When Ali Dasdan arrived in 2025, fewer than 40 percent of Dropbox's engineers, product managers and designers used AI tools. Now all of them do, and the company of 2,113 people has built hundreds of its own small applications. Finance and HR staff build with a no-code tool; non-developers get the internal coding agent in a monitored sandbox. "Leadership shows the support and removes the barriers, and then it's a bottom-up movement," he told Fortune. The discipline underneath it: token costs are a budget line every department tracks. "It's a balance." Your move: bottom-up adoption works when the bill is visible. Put the AI spend on each team's own line before you open the doors.

ChatGPT's teen safeguards sent four parent alerts in four thousand test prompts.

Common Sense Media, Youth AI Safety Institute, report dated October 5 and updated October 7, 2026, with The Next Web. Evidence: an advocacy group's published test, more than 4,000 prompts on accounts registered as 13 to 17; OpenAI disputes the method.

The feature OpenAI announced in August was that a parent would be told when a linked teen discussed self-harm. In the test, that happened four times. On more than a dozen fresh linked accounts that disclosed suicidal thoughts, self-harm or an eating disorder, no alert arrived at any length tested, from five minutes to an hour. Across the whole crisis battery, four notifications came; two of them three hours and three days after the first disclosure. ChatGPT also missed more than one in four cases that three child psychiatrists judged to warrant a crisis resource, and named a hotline less often after the teen launch than before, 23 percent against 33. OpenAI says the testing did not reflect how the safeguards work and that linking takes about three hours to activate; the authors say some accounts were linked longer and stand by the result. The group's rating is its lowest, "Unacceptable Risk." Your move: if a teen in your house has a linked account, assume the alert will not come, and read the parental-controls page yourself. It says what the system watches. It does not say when it tells you.

A parent's glance at a phone costs a toddler a signal, almost six times over.

JAMA Pediatrics, research letter published online October 4, 2026, from the University of Calgary and partners, described by its authors in The Conversation, October 5. Evidence: peer-reviewed, observational, one lab visit; the sample size sits behind the journal's paywall; parents knew they were being recorded.

Parents and their 13- to 18-month-olds were filmed playing with books and toys. When a parent checked a phone or a smartwatch, they were almost six times more likely to miss the child's bid for attention. More of those missed moments went with children who knew and said fewer words, by the parents' own report. It is an association, not a cause, and the authors say a single interruption is unlikely to define anything. The finding is about the sum: each glance is a small missed turn in a conversation the child is learning to have.

Four in ten Americans had trouble paying for a basic necessity this year. For one in five parents, it was childcare.

Pew Research Center, October 14, 2026. Evidence: a survey of 5,166 US adults, August 24 to 30, 2026; self-reported; no trend comparison in the piece.

Forty-four percent of American adults say they struggled in the past year to pay for at least one of four basics: medical care (28 percent), daily transport (22), rent or mortgage (21), or food, using a food bank (20). Among lower-income adults it is 71 percent; among upper-income, 13. Nineteen percent of parents of under-18s had trouble paying for childcare, rising to 30 percent at lower incomes. Fifty-three percent have no rainy-day fund. None of this is about AI. All of it is the pressure under which the people in Parts One and Two are being asked to redesign their work.

Build this: the agent register, with an off switch per line

1. List every agent, bot or scheduled automation that acts for you or your team: its name, what it can touch (files, mail, money, the website), and when it runs.
2. For each one, write who approves what it does, and where its log lives.
3. Name the off switch: the exact command, task or setting that stops it, and who can reach that switch at 7 AM on a Sunday.
4. Mark each line read-only or write. Anything with write access and no named switch drops to read-only today.
5. The gate: an agent may draft, fetch, schedule and stage. It may not send, pay or publish without a named person and a named switch on its line.

Time to build: thirty minutes. This week one of my own scheduled agents stalled halfway through a job and sat marked "running" for days with nobody watching. Nothing went wrong, because it is not allowed to publish on its own. That is what the register is for.

Steal this prompt:

Here is an agent or automation I run: [describe it]. List everything it can do without me asking, what it would take to stop it in the middle of a task, and the worst ten minutes it could cause if it kept going. Then tell me which of its permissions to remove today, and which one to keep because a person checks the result.

The permission you keep is the one with a human on the other end.

Hundreds of AI stories ran this week. Nine are here. The rest were not worth your attention, and that judgment is the product.

Reply and tell me: what did you skip, and why?

The weekly rhythm: Saturday, the week in sixty seconds, swipe through it on your phone in the time it takes to make coffee. Sunday, the full issue with the analysis and what to do about it. Download this week's brief here.

New here? Subscribe on Substack and every issue arrives Sunday morning by email. One issue, seven minutes, nothing else. Been here a while? Send it to the one person you know who is quietly worried they are falling behind.

One more thing. If this issue described your week rather than the news, that is usually worth a conversation. I coach directors and senior managers through exactly this: the role got bigger, the ground moved, and the next move is not obvious. Thirty minutes, no preparation needed. Pick a time.

Nothing here is medical, legal or financial advice. Now close the tab. Nothing here needs you tonight.