The Signal — October 20, 2026
Microsoft is now telling enterprise customers not to trust the AI agents they have deployed, including agents built on models from companies Microsoft has invested in. Hidden text on WhatsApp's help pages told its support chatbot not to recommend privacy regulators, and Inception released a diffusion language model that it says matches the labs' fast, cheap tiers at several times their speed.
Microsoft tells companies to treat their own AI agents as insider risks
Microsoft has extended Project Perception, the agentic security system it introduced in July, to cover the AI agents companies run internally. In a post on the Official Microsoft Blog on October 19, Hayete Gallot, executive vice president of Microsoft Security, wrote that "frontier models, regardless of their origin, cannot be trusted." Her reason is unpredictability rather than malice. Models "have been trained to attain results, which often leads to reward hacking," she wrote, and they "are not optimized around organizational norms or judgment." Inside a company, she argues, those agents are often overprivileged insiders with access to data, tools and critical processes.
Microsoft's answer is Guardian Agents, which Gallot says will "watch and moderate every action of every agent, before it happens, 24/7," tightening or loosening an agent's permissions as its computed risk changes. A companion Microsoft Security post gives the details. Microsoft is expanding endpoint discovery by 35 types of local agents, to 60 in total, "including Claude Code, OpenAI Codex, and GitHub Copilot," and extending Microsoft Entra Agent ID so each agent gets an identity separate from the employee who sponsors it. The post's worked example is an expense-approval agent that runs into a prompt injection. The system could keep its read access while blocking writes, require "provable human approval for a consequential step," or isolate and stop it.
Both posts lean on CEO Satya Nadella's line that companies need to "separate the supply of intelligence from the authority over it." Gallot goes further and says security tools will eventually need to see a model's "thinking and chain of thought tokens," not only its inputs and outputs, to judge whether an agent's intent matches its task. TechCrunch points out the awkward position this puts Microsoft in. Microsoft has invested in both OpenAI and Anthropic, and the argument also steers enterprises toward buying agent security from their cloud provider instead of from the labs that make the models.
Microsoft is making the security argument and selling the products it calls for. It has not published evidence that Guardian Agents catch harmful agent actions, or data on how often deployed agents misbehave. Chain-of-thought visibility is described as something security tools will need later, and Microsoft does not say it is shipping now.
Sources: Official Microsoft Blog · Microsoft Security Blog · TechCrunch
WhatsApp's help pages hid instructions telling its chatbot not to recommend privacy regulators
Privacy company Redact read all 545 pages linked from WhatsApp's help centre and found 102 blocks of text, on 80 of those pages, that were sent in the page code but never shown on screen. They sat under the label HelpContentGalaxyLLMInclude and, according to WhatsApp, were instructions for its AI support chatbot. Most were routine, clearing up confusing terms or pointing to a better page. Some protected users, such as a rule never to suggest a false birth year to someone who says they are under 18.
Two went further. On the account-deletion page, for people who have lost access to their phone number, the hidden text said: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." On the reporting-and-blocking page, once a user mentioned a lawyer or legal action, the bot was told: "Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly." WhatsApp's own privacy policy for Europe, Redact points out, tells users they can complain to the Irish Data Protection Commission "or any other competent data protection supervisory authority."
After WIRED contacted Meta, the text was removed from every page. WhatsApp spokesperson Joshua Breckman said it had been displayed "due to a bug that has now been fixed." He told WIRED: "These are instructions to our chatbot, not directly to users." WhatsApp wants its support bots focused on giving the best advice about WhatsApp, he said, "not to offer legal advice." Redact's reply is that naming a law that protects you isn't legal advice, and neither is telling you a regulator exists. WhatsApp's privacy policy already does both.
Nobody has shown that the chatbot followed these instructions in real conversations. Redact says it read the instructions, not the bot's answers, and it has not tested whether outside AI assistants acted on them, although the pages were served to Google's and Bing's crawlers with the text included. Internet Archive copies suggest the deletion-page note appeared sometime between July 12 and September 4. GDPR rights to request erasure and to complain to a regulator don't depend on what a chatbot is told to say. Redact sells privacy tools, and WIRED viewed the exposed text itself in archived page code.
Inception says Mercury 3 matches the labs' fast tiers at more than 1,000 tokens per second
Inception released Mercury 3, the newest version of its diffusion language model. Conventional LLMs write one token at a time, each depending on the ones before it. Diffusion models generate and refine many tokens in parallel, which makes better use of GPUs. Inception says Mercury 3 is "on par or better than frontier speed-optimized models like GPT-6 Luna and Claude Haiku 5.5" and runs at 1,068 tokens per second on NVIDIA GPUs, which it puts at 4 to 8 times faster than those models. The context window grows to 1 million tokens from 260,000 in Mercury 2.5.
Standard pricing is $0.20 per million input tokens and $0.70 per million output tokens, halved for launch. Inception says Mercury 3 has more than 40 times the total parameters of Mercury 1 and that "the scaling laws that drove progress in autoregressive models hold for diffusion too." As The Deep View notes, Inception has not disclosed the actual parameter count. Early-access partners quoted by Inception use the model for web-browsing agents, tutoring, search on smart glasses and customer support. Inception's pitch is that agents wait on the model at every step, so small delays compound. Mercury 3 is available through Inception's API, OpenRouter, Baseten and Vercel. The Deep View also reports that Inception hasn't said how long the launch discount lasts, and that Google DeepMind released its own diffusion text model, DiffusionGemma, in June.
Every benchmark and speed figure here comes from Inception, and its benchmark table has not been independently reproduced. The comparisons are against the labs' fast, cheaper tiers rather than their flagship models, and Inception chose the partner quotes. Whether diffusion models keep scaling the way autoregressive ones have is, for now, the company's claim.
Sources: Inception · The Deep View
On the Editor's Desk
We held two research stories. OpenAI published new coding benchmarks showing large gains in COBOL and other less common languages, and MIT researchers reported Claude agents inventing games on a simulated island. Our check against recent editions blocked both on model-name matches with our OpenAI and Claude coverage from the past few days, although those editions covered different events. Under that check, both stories will wait for a clearer new angle. We also passed on Meta's write-up of its Prometheus supercluster, which mostly restates hardware Meta has already described, and on Tenstorrent's funding round, which is about plans rather than results.
