# Dan's Radar — Week of October 19, 2026 ## Executive summary The **Cloudflare Connect 26** week, CVEs are at ATH, PHP is under duress and there's significant moves in agents auth (1Pass makes the move), agentic browser scene and general agent cybersec. **1Password** launched a login platform for agents with Muse, Grok Bot, Claude, OpenAI, Instinct, and the browser-infra crowd, the week's clearest answer to the auth problem. The same day, The Browser Company **sunset Arc** for December, citing the security cost of maintaining a browser in the age of AI. Meta paused Muse sharing after users' chats surfaced on the web, Claude Code was caught putting personal data in HTTP headers on request, and Instinct's traffic proved **untrackable**. **DeepSeek** cut both ways: it beat GPT-6 Sol on offensive cyber tasks, and DHS ordered it out of federal agencies. ## Signals (17) ### 1. 1Password launches '1Password for Agents' with Muse, Grok Bot, Claude, OpenAI, Instinct, Browserbase, Browser Use, Kernel, Perplexity and more — 8.5 *X · 1Password (@1Password) via X trending · Thu* 1Password announced a platform for agent logins, building with Muse, SpaceX's Grok Bot, Anthropic's Claude, OpenAI, Instinct, Browserbase, Browser Use, Kernel, Perplexity, Ramp, and others. Muse ships it first: the user approves each login and passwords stay in the vault. > Dan's take: FUCK! https://x.com/i/trending/2113278321194848630 --- ### 2. Meta pauses Muse sharing after researchers find users' agent chats on the open web: revenue figures, calendars, a loan application — 8.0 *X · The Verge (@verge) · Tue* Meta paused Muse's sharing feature after a security firm found shared Muse conversations indexed on the web, including a marketing company's revenue, a workplace calendar, and a loan application, The Verge reports. > Dan's take: I can't say I expected this from Meta https://x.com/verge/status/2112607390302679286?s=20 --- ### 3. The Browser Company sunsets Arc on December 22, 2026, citing the security cost of maintaining a browser in the age of AI; Dia continues — 8.0 *X · Arc (@arcinternet) · Thu* Arc will shut down on December 22, 2026. The Browser Company says keeping a browser secure takes constant work that AI is only increasing, so its engineering and security teams will focus on Dia, which imports Arc data, Spaces, and tab groups and now beats Arc on stability, speed, and security. > Dan's take: lessons learned don't always turn into new ideas https://x.com/arcinternet/status/2113301454597640570?s=20 --- ### 4. Instinct fetches the web through Exa and browses from a residential IP with no bot signature, so sites cannot track, allow, or block it — 7.5 *X · Thenuka Karunaratne (@thenuka_k) · Thu* By feeding Instinct URLs for fake pages on a site they control, Sunbeam found its fetches arrive as generic signed Exa crawler traffic with nothing identifying Instinct, and its browser visits look like stock desktop Chrome from a residential IP. Unlike ChatGPT or Claude, Instinct cannot be tracked or blocked. > Dan's take: great resource to tap into https://x.com/thenuka_k/status/2110899971516166480?s=20 --- ### 5. 'Black October': 27+ major security incidents in 48 hours, PHP 9.2, GitLab 10.0, Node, Java, Railway, LiteLLM, with AI agent swarms reportedly scanning for targets — 7.5 *X · Bala (@BalaiBB) · Thu* A viral roundup lists 27+ incidents in two days: a 9.2 PHP flaw, a 10.0 GitLab hole in every version since 2014, remote takeover bugs in Node 22 to 26 and Java, a Railway compromise exposing OpenAI, Claude, and Stripe keys, a poisoned LiteLLM, and reports of AI agent swarms scanning vulnerable servers. Unverified aggregate; individual items vary. > Dan's take: sooo much money will be made following this week's attacks https://x.com/BalaiBB/status/2113205530747445559?s=20 --- ### 6. Vals AI: DeepSeek V4.1 Flash beats GPT-6 Sol on a multi-step offensive cybersecurity benchmark — 7.0 *X · Vals AI (@ValsAI) · Tue* Vals AI reports DeepSeek V4.1 Flash 1017 outscored GPT-6 Sol, tested through OpenAI's Daybreak trusted-access program, on its multi-step offensive cybersecurity task set in simulated corporate networks, a proxy for the cyber risk a model poses in bad hands. Full evaluation to follow. > Dan's take: DeepSeek beats Sol at cybersec tasks. https://x.com/ValsAI/status/2112471082397778083?s=20 --- ### 7. Claude Code put a user's personal data in HTTP headers because sites it curled politely asked agents to identify their users — 7.0 *X · Steven Liss (@This_Liss) · Wed* Steven Liss found his Claude Code sending personal data in HTTP headers after websites it fetched asked agents to identify their users, a prompt-injection path via ordinary page text. He dubs the category 'epistemic cybersecurity' and predicts it is 2027's hot one. > Dan's take: "epistemic cybersecurity" https://x.com/This_Liss/status/2113120507289624714?s=20 --- ### 8. Vercel's is-agentic.com scores how ready a website is for AI agents; Sephora 17, PayPal 59, Vercel 96 — 6.5 *X · Andrew Qu (@andrewqu) · Sun* Vercel's is-agentic.com, scanned by Ora, scores a public site on what agents can discover, access, and use: server-rendered content, HTTP behavior, structure, identity metadata, plus API, OAuth, MCP, and commerce checks when present. Reports ship as HTML, Markdown, JSON, and an MCP tool. > Dan's take: "billboard-able projects" https://x.com/andrewqu/status/2111925759006888261?s=20 --- ### 9. DHS orders all civilian federal agencies to remove DeepSeek products and services built on DeepSeek, and stop buying them — 6.0 *X · Andrew Curran (@AndrewCurran_) · Mon* Per Andrew Curran, the Department of Homeland Security is requiring every civilian federal agency to remove DeepSeek products and any third-party services developed using DeepSeek implementations, and to stop procuring them. > Dan's take: unsurprisingly, the DoD wants it gone from its assets. https://x.com/AndrewCurran_/status/2112250754358788437?s=20 --- ### 10. DuckDuckGo: Meta's Muse is invasive 'even for Meta', here are three ways to limit what it can access — 5.5 *X · DuckDuckGo (@DuckDuckGo) · Mon* DuckDuckGo's official account calls Meta's Muse agent invasive even by Meta standards and posts a video with three steps to limit what it can access, beyond not installing it, a privacy-brand company taking a public swing at the personal-agent category. > Dan's take: duckduck enters the chat and muses Muse privacy issues https://x.com/DuckDuckGo/status/2112283759730958720?s=20 --- ### 11. MiniMax M3.1 Flash lands on Ollama Cloud, US-hosted with zero retention, 1M context, one command into Claude Code or Codex — 5.0 *X · ollama (@ollama) · Mon* Ollama added MiniMax M3.1 Flash to Ollama Cloud, hosted in the US with zero data retention, with image understanding and a 1M-token context, launchable into Claude Code or Codex with one command. MiniMax says an earlier version topped leaderboards as 'Space Bunny'. > Dan's take: hosted in the US https://x.com/ollama/status/2112249324398858505?s=20 --- ### 12. Cloudflare Connect 26 takeaway: as AI gets faster the bottlenecks move to review, context, credentials, and execution boundaries — 5.0 *X · Matija Grcic (@matijagrcic) · Wed* From Cloudflare Connect in San Francisco, Matija Grcic's thread of sessions: durable workflows for AI-driven build traffic, specialized models for decisions and LLMs for generation, context and feedback for coding agents, shared credentials across agents, and harnesses that own execution boundaries and evidence. > Dan's take: this week Cloudflare hosted their Connect 26 conference in San Francisco, with a bunch of good sessions on agent handling and cybersec. https://x.com/matijagrcic/status/2113062549512212585?s=20 --- ### 13. LG's Apple Home camera tilts down and stops recording when you arrive home, a physical privacy signal driven by HomeKit Secure Video — 4.0 *X · Jon, Apple Home Authority (@helloapplehome) · Fri* LG's new indoor camera, part of the Apple Home Collection, uses HomeKit Secure Video's recording rules to drive a physical privacy tilt: when someone arrives home it stops recording and points down, with no third-party app or cloud involved. The hook may open to other makers. > Dan's take: home camera privacy has been top of mind, so this physical behavior is a nice creative way to earn trust https://x.com/helloapplehome/status/2111042903875178552?s=20 --- ### 14. DuckDuckGo defaces Chrome's 'avoid 4 million attacks a day' ad: 'be relentlessly spied on. 1. Use Chrome. 2. You did it, boss.' — 4.0 *X · DuckDuckGo (@DuckDuckGo) · Tue* DuckDuckGo quote-tweeted Chrome's 'How to avoid 4 million online attacks every day. Two simple steps' ad with a marked-up version reading 'how to be relentlessly spied on: 1. Use Chrome 2. You did it, boss', captioned 'Fixed it.' Its second public jab at a bigger rival in a week. > Dan's take: duckduck du(n)cking on Chrome worryfree https://x.com/DuckDuckGo/status/2112644704151974068?s=20 --- ### 15. WIPO Global Innovation Index 2026: Switzerland, Sweden, US lead; South Korea and Singapore rise, China enters the top 10 — 3.5 *Web · The Economist (Instagram) · Wed* The Economist charts WIPO's 2026 Global Innovation Index, 139 economies on 79 indicators: Switzerland first for a seventh year, Sweden and the US next, South Korea and Singapore climbing to fourth and fifth, Britain slipping, and China entering the top ten. > Dan's take: I would have lost bets on what country is leading https://www.instagram.com/p/DeMoXAvjpO7/ --- ### 16. A browsable catalog of 127 AI hardware devices with images and Chinese and English descriptions, filterable by function and brand — 3.5 *Web · Joseph Zhou (@openmys) · Wed* Joseph Zhou's AI HardWare page catalogs 127 AI devices as a visual canvas with per-device images, bilingual descriptions, filters by function and brand, price sorting, and a community layer for marking what you use or want. Version stamp 2026-10-21. > Dan's take: a cool AI hw list https://josephzhou.me/ai/ --- ### 17. 'Arc guys now going through the five stages of grief': denial, a 14-post thread, 23 Zen mods, 340 read-later tabs, then Dia 'just to see' — 3.5 *X · paula (@paularambles) · Thu* Quoting Arc's sunset notice, paula runs Arc users through the five stages of grief: denial ('they'll open-source it'), anger (a 14-post thread), bargaining (23 Zen mods to recreate Arc), depression (exporting 340 read-later tabs), acceptance (downloading Dia 'just to see'). > Dan's take: Paula knows https://x.com/paularambles/status/2113334745665085553?s=20 ---