Monday's digest covers a protocol that went from draft to installed base in five weeks, a security post-mortem that traces a marketplace malware incident back to an exposed vendor key, and a video-generation company handing robotics developers a fully open robot-control model. Cloudflare and Anthropic both shipped agent infrastructure: an open-source browser engine for agents, and a plugin that carries factory paperwork to the point of review. NVIDIA published the deployment recipe for a 2B driving model that runs on the car, and Hugging Face's robotics team released 10,000 hours of video from real paid work.
1. Sierra's Poppy agent protocol hits 1.0, on by default across Shopify and Meta's Muse
Sierra released version 1.0 of the Personal Agent Protocol, or Poppy, the open specification that defines how a customer's AI agent interacts with a company's website, APIs, and business agent. The protocol was announced on October 6 with design partners Meta, Genesys, Instinct, NiCE, Rocket, Shopify, Stripe, and Walmart, and version 1.0 reflects five weeks of those partners testing drafts against real websites, APIs, and agents. A company adopting Poppy publishes a machine-readable file at a well-known path that tells a visiting agent what interfaces exist, how to sign in, and which actions are allowed at which access level, from fully blocked to acting as the user.
The distribution that came with the release is the story. Shopify enabled Poppy for every merchant on its platform across more than 175 countries, so each store now publishes a Poppy file automatically with no extra work for the merchant. Muse, Meta's personal agent, now looks for a Poppy file first on every site it visits. Sierra says more than 100 companies have joined as design partners, 60 of them added with the 1.0 release, and Mercury, Synchrony, and Turkish Airlines are live today, covering banking balances and payments, financing during agent-led shopping, and fare and booking lookups.
Under the hood Poppy composes existing standards rather than inventing a new stack: OAuth for sign-in and scope control, MCP, OpenAPI, and Shopify's Universal Commerce Protocol for the shopping itself, with a commerce extension co-authored by Shopify that connects agent arrival to checkout. The timing is hard to miss. OpenAI shipped ChatGPT Wallet earlier this month to handle payment on the agent side, and Poppy handles the step before that, when an agent knocks on a company's door and has to prove who it is and what it may do. Commerce over agents now has a common handshake, and the companies that control distribution were the ones who signed first.
— Sierra
🔗 Sierra blog · Personal Agent Protocol
2. Cursor traces its October marketplace malware incident back to an exposed Fireworks key
Cursor published a full post-mortem of the October security incident, two weeks after first disclosing that a malicious, unauthorized copy of Anthropic's Claude Code extension had appeared in the Cursor VS Code extension marketplace. The reconstruction starts upstream of Cursor: an attacker obtained an access key Cursor had issued to inference vendor Fireworks, and the key had been exposed on the Fireworks side. With it, the attacker copied data from a read-only bucket Cursor used to share coding agent traces with the vendor for model training. A small number of those traces contained credentials that had not been redacted, and Cursor states that fewer than 0.01 percent of customers had API credentials exposed.
From those credentials the attacker reached select SaaS tools used by Cursor, pulling archived non-production source repositories, limited customer support data and email conversations, product usage metrics, and summaries of some agent conversations. On October 29, using a credential stolen from that exposed data, the attacker placed tampered copies of Anthropic.claude-code 2.1.312 and 2.1.313 directly on the cache serving the extension marketplace. The malicious build was available for roughly 11 hours and at most 5,000 users who requested those cached versions could have received it. Cursor is explicit that Anthropic did not publish the copies, that Open VSX, the marketplace's upstream source, never carried the malware, and that anyone who installed those versions should follow the remediation steps rather than trusting an uninstall.
Containment is dated and bounded. Cursor deactivated the vendor key, rotated credentials, took the marketplace offline, rebuilt the store, and says the last attacker activity it observed was November 1, blocked. Privacy Mode prompts and code were not affected, agent traces were exposed for fewer than 0.05 percent of users who have each been notified directly, and production systems and live traffic were untouched. For the agent ecosystem the lesson is structural: training telemetry shared with an inference vendor is a credential surface, and a supply-chain hit on one partner can reach developer machines through the trusted update channel. Third-party reporting adds that Cursor has moved inference off Fireworks; the official post documents the key deactivation and rotation but does not detail the vendor transition itself.
— Cursor
🔗 Cursor security incident update
3. Runway releases Praxis-1 open weights, a 27B world action model for robot control
Runway released the weights of Praxis-1, its robot-control model, under Apache 2.0 with inference and fine-tuning code attached, making it usable for commercial products. Praxis-1 was introduced in September as Runway's first world action model, built on the large-scale video pretraining behind the company's general video models. It is a 27-billion-parameter mixture-of-experts diffusion transformer that predicts video and robot actions together: it takes an instruction, the latest camera frames, and the robot's pose, returns a predicted chunk of future video plus 1.6 seconds of motion at 15 Hz in 24 action steps, and repeats as new frames arrive.
The benchmarks come with honest labels. Runway reports 46.2 percent success across 1,200 episodes on NVIDIA's RoboLab-120, against 42.9 for FLUX 3 Action, 36.8 for Cosmos3 Nano, and 28.0 for pi-0.5, but those are vendor self-reports that have not been independently reproduced, and The Robot Report notes the model ranks fifth overall on the leaderboard behind two agent systems and two other architectures. Runway's leadership claim holds within the world action model class and among open-weight end-to-end policies. Since September, launch partners have run the model on their own hardware: Noble Machines on a legged humanoid, Standard Bots on a six-axis industrial arm, and Ultra on a dual-arm warehouse robot, with one reported task learned from half an hour of examples and completed 15 times out of 15.
The hardware range is as much a part of the release as the license. Praxis-1 runs from data center GPUs like the H100 and B200, through workstation cards like the RTX 5090 and RTX PRO 6000, down to Jetson Thor on the robot itself, with weights on Hugging Face and native LeRobot support alongside vLLM-Omni and hosted inference on Runway's Reactor. Fine-tuning supports both full training and LoRA. The company is equally direct about limits: the model can confuse similar-looking objects, handles vague instructions poorly, and cannot yet reliably plan long action sequences on its own. A video-generation lab putting a robotics-adjacent foundation model under a permissive license with the full adaptation stack attached is a genuine event for a field where frontier policies mostly live inside closed labs.
— Runway · The Robot Report
🔗 Runway
4. Cloudflare open-sources Kitesurf, a stateless browser engine built for AI agents
Cloudflare released Kitesurf, its browser engine for AI agents, as open source under Apache 2.0, making good on a commitment repeated at the engine's August introduction and its September update with WebMCP support. Kitesurf runs entirely on Cloudflare Workers and is stateless by design: it parses HTML, applies CSS, executes page JavaScript, and renders screenshots without a browser container, aiming to cost less CPU and memory than a full Chromium deployment while scaling across Cloudflare's network. It exposes the Chrome DevTools Protocol, so existing automation clients like Puppeteer, and agent harnesses that speak CDP, can connect by changing an endpoint.
The repository shows how the engine is assembled. Kitesurf compiles an ecosystem of Rust packages to WebAssembly: Blitz handles HTML parsing, the DOM, layout, and painting; Stylo handles CSS; the Boa JavaScript engine runs inside WebAssembly only as a last resort when page scripts cannot run in Dynamic Workers; Linebender libraries provide text layout and 2D graphics, and Krilla generates PDF output. The code is organized into three parts, an engine that manages browser sessions and client connections, a page script layer, and a renderer, with a CLI alongside. Developers can run it locally or deploy their own instance to their Cloudflare account, which requires a Workers Paid plan because Kitesurf uses Dynamic Workers to create an isolated Worker per page.
Cloudflare's own caveats matter for anyone evaluating it. The project is labeled experimental and under heavy development, with compatibility work tracked against the Web Platform Tests, and pages relying on features the engine does not support may not behave as they would in Chrome. The repository also warns that the engine has no built-in authentication and that a workers.dev address is public by default, so anyone who learns the URL could browse through it and consume the operator's paid resources; Cloudflare says to put Access or another auth layer in front of any deployment. For agent builders the release lands between two existing options, headless Chromium with near-full compatibility and high cost, and managed browsing APIs that hide the machinery, and it makes the way agents see pages something teams can audit rather than trust.
— Cloudflare
🔗 Cloudflare blog · GitHub repository
5. Anthropic launches Claude for Manufacturing with 17 skills and four system connectors
Anthropic launched Claude for Manufacturing, a plugin for Team and Enterprise plans that bundles 17 skills aimed at specific factory jobs rather than general chat. The skills cover sales, quality, operations, supply chain, design, and setup: an estimator can have Claude read a customer request, list what is missing, compare costs on similar jobs, and draft the quote; a quality engineer can document a failed inspection, check past reports for the same problem, and draft the corrective action report; a technician can have Claude read sensor exports, repair notes, photos, and the manual, then rank likely causes of a breakdown; a buyer can prepare supplier requests for quotes and compare the bids that come back.
The plugin works from the systems manufacturers already run through four connectors: Autodesk Fusion, where Claude generates design variations from an existing model and scores them against engineering targets; Infor, for purchase orders and stock lookups; Microsoft 365, for procedures, supplier emails, and exported reports; and Oracle NetSuite, which lets estimators price new work against actual orders, inventory, and job costs. Teams running systems without a connector can save regular exports to Microsoft 365 and have Claude work from those files. Infor is also releasing its own plugin that goes further: after a buyer approves, Claude can release a purchase order to an alternate supplier and reschedule affected production in Infor, with access following the buyer's existing permissions.
The control model is the point Anthropic keeps returning to. Skills are built to end with a user's review, Claude links figures and claims back to underlying documents, and the company states plainly that the plugin does not operate equipment; for physical control Anthropic points to a separate Model Hardware Standard research preview that gives programmable equipment a standard way to describe measurements, settings, and safety limits. The business case rests on a 2025 Manufacturing Leadership Council survey in which 79 percent of manufacturers said they enter data manually, which positions the product at the paperwork layer between machines rather than at the machines themselves. A technical webinar is scheduled for November 17.
— Anthropic
6. NVIDIA details Alpamayo 2 Edge, a 2B driving model that reasons only when it needs to
NVIDIA published the deployment details of Alpamayo 2 Edge, a vision-language-action model sized for real-time operation on DRIVE AGX Thor, the company's onboard automotive compute. The model pairs a 2-billion-parameter Nemotron-based reasoning backbone from Cosmos 3 Edge with a diffusion action expert, taking surround-camera observations, ego-motion history, and navigation inputs to produce driving trajectories along with Chain-of-Causation reasoning, an explanation of why the chosen action fits the scene. Inference optimization with TensorRT and the DFlash2 speculative decoding method brings pixel-to-trajectory latency to 160 to 190 milliseconds on the target hardware.
The design choice that stands out is adaptive reasoning. Driving video is dominated by frames where no new decision is needed, and generating reasoning text for all of them would waste the tight onboard compute budget. The model can therefore emit a special marker that ends explicit reasoning during routine driving and expand the full causal chain only when the scene calls for it, which cuts token generation without shutting down the visual or action paths. NVIDIA reports that closed-loop reinforcement learning post-training in AlpaGym improved closed-loop driving performance by 48.9 percent over the best checkpoint trained without it, and that AlpaJudge, a human-calibrated evaluation and reward model, was used to score reasoning traces, select training examples, and serve as the RL reward.
The release follows the open pattern NVIDIA has applied across its robotics stack. Alpamayo 2 Edge weights are on Hugging Face with Apache 2.0 licensing, alongside the larger Alpamayo 2 Super, a 34-billion-parameter reasoning model used to autolabel causal chains for distillation, and the AlpaSim and AlpaGym open frameworks for closed-loop evaluation and training. Reporting around the launch puts the training data at roughly 115,000 hours of multi-camera driving video and 3.7 million causal-chain labels. For AV developers the deliverable is a repeatable loop: run the judge on samples, pick training data that actually teaches something, and reward reasoning quality rather than only outcomes.
— NVIDIA
🔗 NVIDIA developer blog · Alpamayo 2 Edge on Hugging Face
7. Hugging Face's LeRobot releases 10,000 hours of egocentric video from real paid work
LeRobot, Hugging Face's robotics project, released RoboCap-10k, a dataset of 10,000 hours of egocentric video captured with 3D head and hand tracking. The data covers 619 paid work tasks across 21 industries on five continents, recorded with six-camera and dual-IMU hardware, and it is aimed at training embodied AI and robotics models on what human labor actually looks like rather than on laboratory demonstrations. The team announced the release through its official channels, and the dataset follows the LeRobotDataset format hosted on the Hub, the same streaming format the project uses for its community collections.
The gap this targets is the one robotics researchers keep naming. Most robot policies train on data collected in structured academic settings by small teams, which caps the diversity that generalization depends on, and LeRobot has spent the past year arguing that generalization is a data problem before it is an architecture problem. Real paid work is the extreme opposite of lab data: the tasks are chosen by economic demand rather than research convenience, performed in unstructured environments, and captured from the worker's own point of view with hand pose included, which is exactly the supervision signal manipulation models need.
There are also reasons to read the numbers carefully at release time. The announcement comes from the project itself, per-task coverage across 21 industries is uneven by construction, and how well egocentric human video transfers to specific robot embodiments remains an open research question that papers such as recent latent-action alignment work are still testing. Even so, the trajectory is clear: between open robot models like Runway's Praxis-1 with native LeRobot support and labor-scale open data like this, the input side of robot learning is becoming something a small lab can actually assemble.
— Hugging Face LeRobot
🔗 LeRobot
KD Agentic · AI Daily Digest
