AWS’s agent-built emulator held 32,050 commits when we read its public repository on 14 November, the newest by accounts named for agents. In the same weeks, Railway said attackers’ “Unauthorized spend on the stolen keys was estimated to reach ~$740,000”, in its incident report on an October breach that targeted AI provider keys.
As we read the week’s evidence, the agents that worked ran inside a harness that limited what they could touch, and the losses came through the surfaces around them: keys, vendors and open apps.
Business Pill · The Model and the Harness
An evergreen Business Engineer explainer on why products built on the same model differ: the harness around it. It teaches the general idea only and does not discuss AWS, OpenAI, Railway or Fireworks.
The key insight: As we read the week, AI agents produced at scale where a harness limited them, 32,050 commits at AWS by our count and more than 500 agents at OpenAI, while the losses, about $740,000 of stolen-key spend at Railway and two Fireworks breaches, came through keys, vendors and access settings.
The emulator’s pace has slowed but not stopped. By our count, 4,971 commits landed on 21 October, its first day, and 19,816 by 28 October. From 1 to 14 November it added 7,086, about 545 a day, by our arithmetic. Its issue files show 14,184 in the fixed folder and 6,543 in the open one, so 68% are now fixed, up from 12,708 fixed at the 10 November commit, as our first count showed. The open folder has stayed flat since then.
OpenAI says it runs “over 500 agents that run proactively in the background doing meaningful work”, in a Developers blog post on how it secures persistent agents such as OpenClaw. It treats the agents, their environment and the code they write as untrusted, and limits network, files, processes and secrets, as our piece on its controls set out. On secrets, it says, “we manage secrets through a credential broker so secrets are not visible to the agent”.
Cumulative commits in the public aws/aws-emulator repository, counted before 00:00 UTC on each date from 21 October 2026, with the last point the full count as of the newest commit on 14 November 2026. Counts and the daily rate are our own, via the GitHub API. Commit counts measure activity, not quality.
Where the Seams Showed
Railway says its “internal forensic investigation suggests AI provider keys were the primary target of the attack”, the keys behind the $740,000 of spend covered in our Railway piece.
Fireworks AI, the inference provider valued at $17.5 billion in July, says in its bulletin update that on 24 October an unauthorized third party reached its development machines and ran a workload that led to additional customer data impact. Notion disconnected from Fireworks by 3 November, and TechCrunch reported Fireworks was the vendor behind an October breach of Uber driver data; state notices list 7,870 people in three states, by our sum.
Claroc found 35,578 of 37,571 live Grok Build apps open to anyone, 94.7%. In its own test, it says, clicking Publish on an app Grok built “proposed Anyone with the link as the access setting”, as our piece on the open apps reported.
The platforms underneath had their own week. The Microsoft 365 outage that hit Copilot ran about 37 hours 51 minutes by our arithmetic before Microsoft said service was restored, as our outage coverage tracked. Anthropic’s elevated errors on claude.ai, Claude Code and platform.claude.com lasted about 120 minutes.
What the Two Lists Share
As we read them side by side, Railway’s and Fireworks’ incidents involved secrets and system access, two of the four limits OpenAI describes, and Grok Build’s involved who can open an app. The outages were at the platform layer that agents run on. None of the companies attributed its incident to a model’s output in the statements we read.
As we read OpenAI’s post next to Railway’s report, the control that matters is where the secret lives: OpenAI says its credential broker keeps secrets out of the agent’s view, while Railway says AI provider keys were the attackers’ primary target.
As we read Claroc’s test, the default in the tool decided the exposure: clicking Publish proposed Anyone with the link, and 94.7% of live Grok Build apps opened for anyone.
OpenAI Developers blog, Securing persistent agents like OpenClaw at OpenAI
“Agents, the environment they execute in, and the code they write are considered untrusted”
Three Implications
FOR BUYERS OF AGENTSOpenAI lists four sandbox controls, for network, workspace, process and secrets; Railway’s and Fireworks’ incidents involved secrets and system access.
FOR AGENT BUILDERSAWS’s emulator added 7,086 commits from 1 to 14 November, about 545 a day, while its open issue files stayed flat at about 6,540, by our count.
FOR INFERENCE VENDORS One provider, Fireworks AI, appears in at least three of the week’s incident trails: its own bulletin, Notion’s disconnection and the Uber driver-data breach TechCrunch traced to it.
The framework argues: “The surface, not the model, governs autonomy. The agentic surface — the harness — is becoming where value pools in the entire AI stack.”
As we read it, this week showed the same from the failure side: the incidents we tracked involved keys, vendors and access settings around the model. The framework predates these incidents and does not discuss them.
What Is Not Established
Microsoft has not published its post-incident report and has not named the outage’s cause. Commit counts measure activity, not quality, and we did not test the emulator. Fireworks’ and Railway’s statements describe their own incidents; we did not verify how the attackers got in. Claroc’s figures are its own scan.
We did not contact AWS, OpenAI, Railway, Fireworks AI, Claroc, Microsoft or Anthropic for this piece.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
AWS’s agents passed 32,050 commits with 68% of their issue files fixed, and OpenAI runs more than 500 agents behind a credential broker. The week’s losses, from $740,000 of stolen-key spend to 7,870 people in Uber’s driver-data notices and 94.7% of Grok Build apps left open, came through keys, vendors and access settings, not through what a model wrote.
A note on sourcing. On 14 November we read OpenAI’s Developers post on persistent agents, Railway’s incident report, Fireworks AI’s security bulletin and Claroc’s Grok Build post, and counted the aws/aws-emulator repository ourselves through GitHub’s API. The analysis draws on our earlier pieces linked above, each sourced to its own primaries. Counts, rates and percentages are ours. This piece expands a pattern from our weekly issue for 7–13 November. We did not contact the companies for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
