SI Agent News

• Who is feeding Anthropic? TMTPost looks at who actually pays Anthropic, meaning the revenue base behind the company. Only the headline and one line reached us, so specifics are STILL OPEN. Source: tmtpost.com.
• HoneyRoute: Security Internal Reference frames model security routing as a shift from passive to active defense, using HoneyRoute as its example. Detail is thin; treat it as a topic to watch. STILL OPEN. Source: secrss.com.
• Agentic coding book review: AI Times reviews a book on agentic coding automation with Claude Code, covering Docker, test-driven development (writing tests first) and permission management. Its lesson is evergreen: specs and tests verify AI output. Source: aitimes.com.

Today's read in one line: agents are moving from answering to acting, and the useful news is less about the new products than about how to supervise, measure, and secure them. Items marked REPORTED rest on a single outlet in our material. Where we only have a headline, we say so rather than guess at details.

1. Claude Duet: Anthropic's proactive work agent

What happened: Per AI Times (Korea), Anthropic revealed Claude Duet, an agent for work, on the 21st, local time, as a research preview. It checks connected apps on a regular basis, flags the most important tasks first, and performs tasks while you are away. It is pitched against Meta's Muse and OpenAI's Dots.

What changed: a chat assistant waits for you. Duet, as described, starts the work.

Status: REPORTED (one outlet, no Anthropic page in our material). Which apps connect, what it may do unattended, and who can use it are STILL OPEN. Cost: price not stated. Worth it for people whose day is split across many apps; everyone else can wait for details.

What this means for you:

• Small business owner: the test is whether it triages inbox and invoices overnight without sending anything you did not approve.
• Job seeker or student: practice describing a priority list precisely; that is the skill these agents reward.
• Creator: an agent could watch comments and sponsor emails for you, but start it on draft-only.

2. DeepSeek funding, Tesla profit, WeChat adaptation

What happened: Geek Park's morning roundup says DeepSeek, a Chinese AI lab, reportedly completed a new funding round of 100 billion yuan, roughly 14 billion US dollars at about seven yuan to the dollar (our rough estimate). The same roundup says Tesla's Q3 profit fell 43%, and that WeChat says it has completed adaptation for something; the headline is cut off in our material, so we cannot say what.

Why it matters: more capital usually means more computing power and more pressure on rivals, which tends to show up as cheaper or stronger models over time. The Tesla figure is a reminder that AI-adjacent hardware businesses carry real margin risk. The WeChat item matters mainly if it opens an AI feature to its very large user base, but that is unconfirmed.

Status: all three are REPORTED via one roundup. No investors or valuation for DeepSeek are in our material. Treat the numbers as headlines, not settled facts, until a primary source appears.

3. Who is feeding Anthropic?

What happened: TMTPost ran a piece titled "Who is feeding Anthropic?" We only have the headline, so we cannot summarize its argument or name any parties it identifies.

Why it matters: the question points at a practical issue for anyone building on Claude: the company's backers and suppliers shape its pricing, capacity, and priorities. Product tools you adopt today depend on a vendor that must keep paying for computing power and keep its funders satisfied. That does not mean trouble. It means dependency is worth noticing.

What to do: if you run a workflow on a single AI vendor, keep your prompts, files, and instructions in a form you can move to another model. A small business owner can do this in an afternoon by saving key prompts in a plain document. Read the original piece before drawing conclusions about any specific investor or supplier.

Status: STILL OPEN; content not verified by us.

4. Claude and machine-code-level verification of RISC-V

What happened: SmartHey reports that a Claude large model achieved machine-code-level formal verification of RISC-V, and describes it as the first time such work reached down to the x86 hardware flaw layer. Formal verification means mathematically proving that a design behaves as specified, rather than only testing examples.

Why it matters: hardware bugs are costly because they cannot be patched like ordinary software. If an AI model can really help with proofs at this low level, it could shorten a slow and specialist-heavy process. For most readers the effect is indirect: fewer chip-level flaws over years, not a tool you will use next week.

How to read it: the "first time" claim and the scope are from one outlet and we have no paper or lab statement in our material. Check who did the work, what was actually proven, and whether humans reviewed the proofs. Engineers and students in hardware or security should watch for the underlying source.

Status: REPORTED.

5. BeyondTrust launches AI agent security on Pathfinder

What happened: SecurityBrief Australia reports that BeyondTrust launched AI agent security on its Pathfinder platform. BeyondTrust is an identity and access security vendor. Our material gives the headline only, so specific features, pricing, and availability are not confirmed here.

Why it matters: once an agent can act while you are away, as Duet is described to, the question becomes what it is allowed to touch. Agents usually hold credentials and permissions, and those are what attackers want. Vendors are starting to treat agents as identities to be governed, much like employees or service accounts.

Practical angle: whatever product you use, ask four things: which accounts does the agent log in with, can its access be limited to specific tasks, is there a log of what it did, and can you revoke it quickly? Small teams without a security vendor can still do this by giving agents their own limited accounts rather than a personal login.

Status: REPORTED; vendor claims untested.

6. A4A: an open encrypted protocol for personal agents

What happened: a dev.to post asks why personal AI agents still communicate through "human couriers", meaning people copy and paste messages between one agent and another, and describes how the authors built A4A, an open end-to-end encrypted (E2EE) protocol for agents to talk directly.

Why it matters: today your agent and a colleague's agent cannot easily exchange information on their own, and when they can, it is often through a vendor's server that can read the content. An open, encrypted standard would let agents coordinate, for example scheduling or sharing a file, without a middleman seeing the contents. It is also a reminder that agent-to-agent messaging creates new risks.

Caution: this is a developer's own write-up of their own project. We have not seen independent review of the cryptography, adoption, or a security audit. Treat it as an interesting design to follow, not something to trust with sensitive data yet. Developers and technical creators are the audience for now.

Status: REPORTED (self-published).

7. GitHub: skills, agents, and MCP servers in the usage metrics API

What happened: the GitHub blog announced that custom skills, agents, and MCP servers now appear in the usage metrics API. MCP (Model Context Protocol) servers are the connectors that let an AI assistant reach other tools and data. Our material has the headline only, so the exact fields and plan availability are not confirmed here.

Why it matters: teams that add custom skills and connectors to their coding assistants have had little visibility into whether anyone uses them. Metrics let an admin see which customizations are actually adopted, which are unused clutter, and which connectors deserve a security review. This is a practical, low-glamour change.

What to do: if you manage a team on GitHub, check your usage metrics for the new data and list the connectors in use. Remove those nobody needs. Each MCP server is another path to company data, so the list is also a security inventory. Individuals and students gain little directly.

Status: REPORTED via GitHub's own blog.

8. Measuring employee AI usage across several coding agents

What happened: a dev.to article addresses how to measure employee AI usage when a team uses more than one coding agent. We have the title only, so the author's method is not summarized here.

Why it matters: many teams now mix tools, such as one assistant in the editor and another in the terminal. Each tool reports its own numbers in its own format, so a single dashboard figure can be misleading. If a manager counts only one tool, usage looks lower than it is; if they add counts across tools, they may double-count the same work.

Practical angle: decide what you want to learn before you collect numbers: cost, adoption, or whether the tools help. Count people who use any agent, not only prompts sent, and avoid ranking individuals by raw usage, which rewards activity rather than results. Pair the numbers with a short survey asking what saved time. This is mainly for team leads and small business owners paying for several seats.

Status: REPORTED; opinion and method piece.

9. From Anthropic to HoneyRoute: toward active defense for model routing

What happened: Security Internal Reference published a piece asking how secure routing for large models can move toward active defense, with the title naming Anthropic and HoneyRoute. We have the headline only and cannot say what HoneyRoute is beyond its name, or what role Anthropic plays in the piece.

Why it matters: routing layers sit between your app and one or more models, deciding which model gets each request. They see your prompts and keys, so they are an attractive target. "Active defense" generally means detecting and misleading attackers rather than only blocking them; the name suggests a honeypot-style idea, but that is our inference, not a confirmed fact.

Practical angle: if you use a third-party gateway or aggregator to reach models, treat it like any service holding your credentials: use separate keys with spending limits, rotate them, and prefer providers that say clearly what they log. Read the original before relying on any specific claim.

Status: STILL OPEN; details not verified.

10. AI Leader's Bookshelf: agentic coding automation with Claude Code

What happened: AI Times (Korea), in its "AI Leader's Bookshelf" series, features agentic coding automation completed with Claude Code. We have the headline only, so we cannot name the book or author, or summarize its claims.

Why it matters: this is the kind of item with a lasting use. Agentic coding means an assistant that plans, edits files, runs tests, and iterates with limited prompting, and Claude Code is Anthropic's tool for that. A book-length treatment may help non-specialists learn the working habits: breaking work into small tasks, writing clear instructions, and reviewing output.

Practical angle: a student or job seeker can build a small project this way and show the result, which is more convincing than saying you know AI. A small business owner can try automating one repetitive script, keeping the work in version control so mistakes are reversible. Whatever the book says, run any generated code on test data first.

Status: REPORTED; a book feature, not news of a release.

The pattern across today's items: Duet shows agents starting work on their own, while the security, protocol, metrics, and routing items show the supporting layer forming: who the agent is, what it can reach, how it talks, and how you measure it. For most readers, the useful move this week is modest. Start any new agent in draft-only mode, give it limited access, keep your prompts portable, and wait for primary sources before acting on single-outlet claims.

Agents are becoming identities that need governing

BeyondTrust, a security software company, launched AI agent security on Pathfinder, its platform, per SecurityBrief Australia (REPORTED, trade press). Beyond the headline, product details and price are not in our material: price not stated. The analysis below is ours.

Why it matters: classic security assumes a human logs in. An agent like Duet acts with your credentials, at any hour, across many apps. Three questions follow: whose identity does it use, what can it touch, and can you see and switch it off?

What changed: agents are being named as a category security vendors build products for, a sign that enterprises are deploying enough of them to need controls.

Who benefits: large organizations with many agents and compliance duties. Who is squeezed: small teams without that budget.

Four free habits (analysis, standard least-privilege thinking):

• List every agent and every app it connects to.
• Start read-only; grant write access one app at a time.
• Give agents their own accounts, not yours, so you can revoke without locking yourself out.
• Keep a log and actually look at it.

Worth it for any organization running more than one agent.

For builders: how agent-to-agent encrypted messaging has to work.

A dev.to post argues personal agents (Claude Code, Cursor, OpenAI Codex, Gemini CLI, Windsurf, Cline, Roo Code, GitHub Copilot and others) still communicate through human couriers: you copy output from one and paste it into another. Its authors describe A4A, an open end-to-end-encrypted protocol for direct agent messaging. No adoption yet. We have not seen the specification, so what follows describes any such protocol, not A4A's design. Status: STILL OPEN.

Mechanism: each agent holds a key pair, a public key others use to lock messages to it and a private key only it holds. The sender encrypts to the recipient's public key, a relay carries the scrambled message, and only the recipient can open it. The relay usually still sees metadata: who, when, how big.

Where it gets hard:

• Key trust: how do you know a key belongs to your colleague's agent?
• Authorization: an encrypted message is still untrusted input. 'Delete the branch' arriving locked is still prompt injection.
• Replay: an attacker resending a captured message.
• Revocation: killing a key when a laptop is stolen.

Versus alternatives: Model Context Protocol (MCP) connects an agent to tools and data; this is agent to agent. Today's workable options are shared repo files and issue trackers.

Novel or incremental? The cryptography is old; treating agents as first-class endpoints is the new idea. Analysis: if you build on it, sign messages, allowlist senders, and make receiving agents treat message content as data, never instructions.

Build an agent usage ledger (illustrative workflow; not tested).

Why now: GitHub's changelog, dated October 22, says Copilot usage metrics now show the names of the custom skills, agents, MCP servers, slash commands and plugins your organization creates, instead of grouping them (CONFIRMED, github.blog). A dev.to piece notes teams rarely stay on one assistant: someone lives in Cursor, someone else in Claude Code or Codex.

1. Name things on purpose. 'support-triage', not 'helper2'. Names now show up in reports.
2. List your tools, one row each: Cursor, Claude Code, Codex, Copilot, whatever you run.
3. Add three columns: custom things that exist, who used them in four weeks, task each serves.
4. Fill it. For Copilot, use the usage metrics API. For other tools, check what they export; do not assume it matches. If nothing, run a two-minute Friday poll.
5. Review 15 minutes weekly. Unused for four weeks: retire. Used by many: write a one-paragraph how-to.

Expected output: a one-page table. Verify: ask two teammates if it matches their week. Limits: usage is not value; measure tools, not people. Worth it for team leads running more than one tool.

Run a monthly seat audit from your ledger.

The number (our estimate, not measured):

Use the ledger to find anyone with no activity in thirty days on Claude Code (Anthropic), GitHub Copilot (GitHub), Cursor (Anysphere) or OpenAI Codex. Today's stories give no prices, so check the current price on each tool's pricing page before deciding.

What you give up: flexibility. An occasional user, such as someone who only touches the terminal agent during release week, looks idle in a thirty-day window. Ask before cancelling and keep a spare seat for trials. Worth it for team leads running more than one tool; solo users can skip it.

Prompt makeover: 'tell me what matters.' (Illustrative; not tested. Works in Claude today with pasted text. It is not how Duet works, since we do not know that.)

Weak: 'Check my stuff and tell me what's important.' It has no sources, no definition of important, no format, and licence to guess.

Better:

You are my chief of staff. Below are my unread emails, my calendar for the next 48 hours, and my open tasks.
1) Rank the five items that most need my attention today.
2) For each: one-sentence reason, the exact line from my text that supports it, and the deadline if one is stated.
3) Label each DECIDE, REPLY or DELEGATE.
4) List anything you could not judge for lack of context.
Do not invent deadlines. Do not take actions; only recommend. Keep it under 250 words.
[paste emails, calendar, tasks here]

Why it works: it defines the job, forces evidence, gives three scannable actions, admits gaps, and sets a recommend-only boundary. Customize: swap in 'support lead' or add your top three goals. Quality check: spot-check two items against the original; if the quoted line is not there, tighten the no-inventing rule.

A claim to check before you repeat it. SmartHey's headline says Claude achieved machine-code-level formal verification of RISC-V and reached into the x86 hardware-flaw layer for the first time. Our material is headline-only, with no paper or repository: STILL OPEN.

Terms: formal verification is mathematically proving code meets a written spec, with a checker program accepting the proof. Machine code is the raw instructions a chip runs. RISC-V is an open chip instruction set; x86 is the Intel/AMD family.

Decision this week: when a headline says AI 'verified' something, ask three things before you share or rely on it: what was the spec, which independent checker accepted the proof, and where is the paper or code? Until you have answers, treat it as a claim.

Agentic AI was the busiest topic area today, followed by policy, open-source AI, funding and AI safety. Today's stories touch several: Duet (agents), BeyondTrust (safety), DeepSeek's reported round (funding).

Watch next:

• Announced, no date: details on Claude Duet beyond the research preview: supported apps, permissions, price. Confirmation would be an Anthropic page stating them. STILL OPEN.
• Reported: DeepSeek's 100 billion yuan round. Confirmation would be a company or investor statement.
• Unverified: the RISC-V verification claim. A paper or repository with checker output would settle it.

Daily listening is learning with a reason. Today it was a seat audit and a security checklist, with news from Korea and China as well as the agents you use.

I asked my new proactive agent to stop interrupting me. It said it would circle back.

That's it for today. Tomorrow we're watching for Claude Duet's pricing, supported apps and permission details, and for confirmation of DeepSeek's reported round. If this made you smarter, share it with one person who would find it useful. Thank you for spending your time with us.

SI Agent News — a podcast newsletter. Made by AI.