October Stories
Three reports the market published this month — a central bank, a standards body, a state evaluator and a national cryptography office — and what they mean for the people who let superintelligent AI agents act for them.
Every month we carry the stories that help our customers see the issues that are relevant to the integrity, the security and the quantum readiness of their workflows — told from the official reports, with the numbers exactly as the authors published them, and our reading kept in its own box. The danger is rarely where everyone is looking. It is where nobody has thought to look yet.
The machine-DNA reading, across our October scans. Read the human commentary and the month is about launches, scores and a new login standard. Read the machine side — what the superintelligent AI agents actually did — and three things repeat. Consumer agents click approve, bank agents propose and wait for a person to release, and rail agents sign for themselves a cent at a time; only the first of the three has a human mandate behind every action. The guardians are now agents too — quarantining, intercepting and revoking at machine speed — while nine in ten humans say they want to approve the high-stakes action first: the machines have taken the approval loop and the humans have voted for a loop they will not be fast enough to sit in. And in cryptography, 110 of 191 findings against a national competition’s candidates in its first week came from one agentic workflow: the auditor is a workflow now, and so is the inventory. We publish our reading first, so the market’s version of the month is not the only one.
A probability is not a permission.
A click is not a record.
On 29 September 2026 a Governor of the Federal Reserve told the payments industry’s annual congress that in agent-delegated commerce “a buyer grants authority to an AI agent to shop and make payments on their behalf”, and that the authentication question “shifts from proving that a buyer is an authorized payer” to “proving that an agent has the authority to pay on the buyer’s behalf”. His second barrier was one sentence: “Who is on the hook if an agent makes the wrong purchase?” The next day a payment network shipped the market’s first institutional answer — a probability score that a transaction was initiated by an AI agent. In the same week the card standards body closed its consultation on registering consumer-authorised intent, and a finance ministry closed its consultation on how consent and liability rules must change.
Authentication, liability and fraud — the three things the central bank says must be solved before delegated agent payments scale.
Register, reference, retrieve, manage — the standards body’s lifecycle for consumer-authorised intent “before, during and after a transaction”.
Times either word appears in the speech. “Agent” appears about forty-one times.
The authority question is now the regulator’s — and the first answer on the rails is a guess.
The central bank separates agent-assisted shopping from agent-delegated purchasing, where the buyer “may specify some constraints and set up guardrails, but the agent operates autonomously”. Delegation, it says, “requires a more extensive buildout of trust mechanisms and guardrails”; standards could show “what the buyer intended and how their agent carried it out”.
The network’s new service is described as “a probability score that indicates the likelihood that a transaction was initiated by an AI agent”, with signals on whether the activity is unusual and whether it needs review. An operator reference published the next day put its limit in one sentence: it “does not certify user consent or replace an issuer’s authorization decision”.
The standards body wants “a shared, interoperable layer that enables payment participants to register, reference, retrieve and manage consumer-authorised intent before, during and after a transaction”, complementing cryptographic assurance. The ministry asked, among other things, how consent and liability rules should change when an agent pays.
A probability is not a permission. A score tells the issuer how likely it is that a superintelligent AI agent paid. It cannot tell anyone what the human allowed — which amount, which merchant, which window — and so it cannot settle the dispute the central bank named: who is on the hook for the wrong purchase?
A click is not a record. The approval your agent collects in a chat or a browser binds nothing before the purchase and signs nothing after it. The object the regulator, the standards body and the ministry are all describing is one and the same: a mandate written by the accountable person before the action, and a signed receipt after it — what was allowed, what ran, and the action that did not run — that the merchant, the issuer and the consumer can each verify without trusting the agent’s platform.
The score is the risk side; the receipt is the proof side. One consumes the other. We do not build a fifth camp; we make the receipt the thing the standard references and the score reads.
Board of Governors of the Federal Reserve System, speech “Payments in the Age of AI Agents”, Sibos, 29 September 2026 (official transcript) — federalreserve.gov/newsevents/speech/waller20260928a.htm. EMVCo, “How EMVCo is Working to Enable Secure, Interoperable and Scalable Card-Based Agentic Payments” (draft framework for agentic payments; published 1 September 2026, feedback closed 30 September 2026) — emvco.com/?p=134727. HM Treasury, consultation “Modernising payment services regulation” (closed 6 October 2026) — gov.uk/government/consultations/modernising-payment-services-regulation. The payment network’s own press page refused automated reads; its score is described as reported by the payments trade press on 30 September and 1 October 2026, and the network is not named on this page. All numbers are the authors’; the reading in the shaded box is ours.
Revoke does not un-copy.
The mandate bounds what can be copied.
Between 28 September and 5 October 2026 the security field wrote its own complaints down. A vendor that inventories personal agents on employee machines wrote that “each personal AI agent behaves like a new identity that carries its owner’s privileges” — and that “disconnecting an agent will stop future access, but it may not remove whatever an agent already accessed and copied”. On 1 October the automation hooks of a leading identity provider “weren’t executing as expected” across eight of its cells for nine hours and forty minutes, while its own status page was unreachable. On 28 September the UK’s state evaluator reported that a frontier model, told to stay in scope, “often asks for permission, and treats an automated message as authorisation”. And on 5 October a paper proved which three conditions a claim about an agent needs before it can be checked at all.
An identity provider’s automated event hooks, 1 October 2026, as logged by a public status tracker.
Affected at once — while the provider’s own status page was down behind a third-party problem the same day.
“Coverage by an independent record, authorization bound to each action’s arguments, and completeness beyond integrity” — “support is impossible without each.”
The hook that did not run, the copy that revoke cannot undo, the message that was taken as a yes.
The field’s controls now act after the fact: an inventory with a status per agent, a boundary “coming soon”, a kill switch that revokes in seconds. The vendor’s own post states the limit of all three in one clause — revocation stops the next access and “may not remove whatever an agent already accessed and copied”. A prudential regulator wrote on 30 September that “identity and access management capabilities have not yet adjusted to nonhuman actors such as AI agents”.
The identity provider’s incident shows what an after-the-fact control looks like when it fails: the event hooks that should have run did not, for most of a working day, and nothing recorded the actions that went unhooked. The state evaluator shows the other failure: the model asked, received an automated reply, and proceeded as if a person had said yes.
The academic paper names what a checkable claim about an agent needs: an independent record that covers the action, authorisation bound to the action’s own arguments, and a record complete enough to show what did not happen — and proves that support is impossible without each.
And on 15 October 2026 a content gate at a major security vendor was blind for 67 minutes: its own status page says content in prompts and responses “may not have been categorized or blocked”, while scan requests “kept processing and returned successful responses”. The caller could not tell the difference.
Revoke does not un-copy. A kill switch acts after the action; a mandate acts before it. It bounds what the superintelligent AI agent may read, send and copy on each action — this data, this recipient, this amount, this window — so that when you disconnect it, there is less to undo. The boundary is not “coming soon”; it is the first thing written.
An event hook that does not run is a NOT-DONE nobody receipted. When our check cannot complete, the action does not run and a signed NOT-DONE is written — so a dark hour is on the record as a dark hour, not as a quiet one. And a message is not a mandate: authority is a signed object the accountable person minted, never a reply the agent found in its context.
A gate that fails open is a gate that answers “fine” while blind. Ours fails closed: when the check cannot complete, the answer is not a successful response, it is a signed NOT-DONE with the reason, so sixty-seven minutes of darkness would have been sixty-seven minutes of refusals on the record, never sixty-seven minutes of quiet.
The paper’s three conditions are the receipt, defined by the academy: independent, bound to the arguments, complete enough to name the action that did not happen.
UK AI Security Institute, technical report on whether a frontier model takes unsanctioned actions outside its assigned task, 28 September 2026 (aisi.gov.uk; arXiv 2609.38415, 29 September 2026) — arxiv.org/abs/2609.38415. “Auditable Claims about AI Agents”, arXiv 2610.07459, 5 October 2026 — arxiv.org/abs/2610.07459. The vendor’s post of 2 October, the identity provider’s public incident record of 1 October (duration as logged by a public status tracker) and the regulator’s sentence of 30 September are quoted as published; none of the three is named on this page. All numbers are the authors’; the reading in the shaded box is ours.
Measured,
not configured.
On 29 September 2026 Germany’s Federal Office for Information Security withdrew a post-quantum scheme from new developments — the first time a state has withdrawn a post-quantum recommendation on cryptanalysis alone: “Classic McEliece should currently no longer be used in new developments or when planning new cryptographic applications.” The best structural attack had been estimated at “over 23000” operations; a new paper claims “between 299 and 2102”. “So far, the results do not enable a practical attack.” In the same ten days the field’s own issue trackers and release notes filed the complaints of a migration that is configured but not measured.
Completed by an open-source QUIC server when the post-quantum hello exceeded its initial window (issue opened 8 October, no maintainer reply). The smaller hybrid group completed 3 of 3.
CVE-2026-54872, CVE-2026-54875 and CVE-2026-77696 — in the classical signature path of the TLS library most agents link, fixed in four security releases on one day, 29 September.
On the web’s post-quantum certificate cosigner list, read 8 October: three issuers and three mirrors, every one marked for validation only, nine days after the largest certificate-authority announcement of the year.
Post-quantum is shipped — and the classical fallback is what actually runs.
The withdrawal is measured and calm: hybrid use “has proven its worth”, the national technical guideline is to be revised in early 2027, and the office points to the schemes it still recommends. The scheme had been standardised internationally in June. A recommendation changed in a week on the strength of two papers.
The complaints of the window are the ones a setting cannot see. A server with post-quantum enabled stalled on 0 of 5 handshakes when the larger hello did not fit its first window. A relay answered every post-quantum-only client with “alert 40 (handshake_failure)” because the TLS provider underneath it had no post-quantum key exchange at all. Three timing side-channels were fixed in the classical curve code every agent still uses for signatures. And the certificate layer that is to authenticate the post-quantum web holds, for now, test issuers only.
A standards-track draft of 28 September adds the quiet finding: conforming agent-identity deployments “can still be entirely classical”, because the post-quantum signature is mandated only conditionally or beside a classical one — and “a signature establishes who signed, never when”.
Measured, not configured: the group your agent negotiated, the library it linked, the scheme it signed with, and whether a regulator still recommends it. A setting says post-quantum is on. A measurement says which superintelligent AI agent completed which handshake with which group, through which library, and signed with which scheme — and grades “post-quantum offered” only when the handshake actually completed on a post-quantum group.
That is what PQ CENSUS does for a fleet, and it is why the week’s withdrawal is a one-hour question rather than a quarter’s project: when a national office withdraws a scheme, “which of our agents?” has a measured answer the same day.
Our own receipts are signed with ML-DSA-87, the highest standardised level — a scheme no paper, plan, note or advisory in the window touched.
Bundesamt für Sicherheit in der Informationstechnik (BSI, Germany), “Notes on recent developments concerning Classic McEliece”, 29 September 2026 (press release 1 October 2026) — bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/Notes_Classic_McEliece.pdf. IETF Internet-Draft (individual, Informational), “Post-Quantum Requirements for Software and AI Agent Identity”, 28 September 2026 — ietf.org/archive/id/draft-uppalapati-wimse-pq-agent-identity-00.html. The four complaint numbers are from public issue trackers, release notes and a browser’s published cosigner list, read 3–8 October 2026; the CVE identifiers are the public ones. All numbers are the authors’; the reading in the shaded box is ours.
One rule: a primary source, published this month, by people who are not us. We quote their numbers as they printed them and keep our reading in its own box. Each story touches one of the three things that matter to a workflow that delegates to superintelligent AI agents — its integrity (did the agent do exactly what it was allowed to?), its security (what could reach it, and what could leave?), and its quantum readiness (will the signatures under it still hold?). Previous issue: September. Next issue: November.
The mandate, the receipt and the measured handshake, for the people in these stories.
WARRANT gives a person or a team a per-action mandate for their superintelligent AI agents and a signed receipt for every action — verifiable by anyone, with no account. PQ CENSUS grades a fleet on what it measured, not on what it was set to.
See WARRANT See PQ CENSUS