Google's AI coworkers, OpenAI's 372 math claims, and AI tools hacked at Pwn2Own

Google Cloud used its Gemini at Work 2026 event on Thursday, October 8, to announce the 'Gemini agent'. CEO Thomas Kurian called it a single, universal agent for work. Instead of offering a set of separate assistants, Google wants employees to give one agent a goal, such as researching a market, building a model from company data or drafting a deck. The agent then returns finished work inside Gmail, Docs, Sheets, Slides, Chat, Calendar or a developer environment. Google sums this up as giving it objectives, not instructions. The agent is in private preview. According to 9to5Google, Google says it will reach more Workspace customers on select Business and Enterprise plans soon.

The most unusual feature is what Google calls a 'digital coworker'. VentureBeat gives an example: a manager could create an 'Event Planner' agent with its own Workspace account, email address, calendar, Drive storage and company-directory listing. Colleagues would give it work by @-mentioning it in Google Chat or asking it to edit documents. Google says these coworker agents can only see what team members explicitly share with them. They do not get a human employee's full permissions. Each agent has a cryptographically attested identity, its actions go into audit logs, and an 'Agent Gateway' applies company-wide rules to how agents connect with outside systems.

The agent runs in Google's cloud, so a job can last hours or days and keep going after the user logs off. Google describes four kinds of memory: session (the current task), semantic (accumulated knowledge), procedural (how jobs get done) and episodic (past work). The aim is for the agent to learn a company's processes over time. It can set up temporary teams of sub-agents and react to schedules or events. It connects to tools including Salesforce, ServiceNow, Jira, Git, BigQuery, Snowflake, Databricks and Microsoft Teams, as well as any Model Context Protocol (MCP) server. An API also lets it run 'headless', inside other apps, with no interface of its own.

The agent is model-neutral. A 'Smart Routing' feature picks a model for each job based on performance and cost. For now it chooses between Google's Gemini models and Anthropic's Claude models, and Google says other proprietary and open models will follow. Google also announced versions for specific industries. Financial Services, in preview, includes more than 50 foundational skills and data from FactSet, LSEG and SEC filings. Legal, also in preview, is built around document-management permissions and supports iManage and NetDocuments. Versions for government, healthcare and retail are coming later. Google says nearly 90% of Fortune 100 companies use Gemini Enterprise, but that figure describes the existing product, not the new agent.

The launch comes during a crowded few weeks. VentureBeat lists Microsoft's updated Copilot with a background 'Autopilot' agent (September 25), OpenAI's always-on Dots agents (September 29), Anthropic's native Claude integration with Google Docs, Sheets and Slides (October 6) and SpaceXAI's persistent Grok Bot and Team Bots. All of these companies are moving toward the same idea: named AI workers that keep running and have their own memory and identity. What sets Google apart is that customers can keep the same agent setup, company context and skills while swapping the model underneath, even for a competitor's model. VentureBeat notes that Microsoft also supports multiple models.

Several important questions are still open. Google hasn't announced a separate price for the agent or said whether it comes with existing Gemini Enterprise subscriptions. It hasn't given a general-availability date or explained how coworker agents will be set up and licensed. VentureBeat also notes that Google hasn't published independent benchmarks showing how reliably the agent finishes long tasks that span several apps. Some of the cost controls are not new either. The project-level spending caps that pause an agent when its budget runs out were announced in August. Until pricing and reliability data appear, buyers can't judge what a 'digital workforce' would really cost to run.

For buyers, the choice is no longer just which chatbot to license. It is which platform they trust to hold company context, agent identities and permissions. For builders, the support for MCP and the headless API means a skill or connector written once can work inside Google's agent and in rival products. The hard problems are shifting to governance: what each agent is, what it can see, who approves its actions and who pays for its compute. Companies that set clear rules for this early will be able to adopt AI agents more quickly and with fewer mistakes.

Why it mattersThe fight over enterprise AI is shifting from whose model is best to whose platform holds company context, agent identities and permissions. Google is betting that being open to rival models, including Claude, will win buyers.

At 6pm EDT on October 6, OpenAI posted a large set of mathematical results from an unreleased internal model to GitHub. Scientific American, which first reported the release, says it contains 372 result 'families'. OpenAI says each one resolves or substantially advances an open question in mathematics or theoretical computer science. A family groups a main theorem with related proofs and consequences, so there are more manuscripts than families. There were 722 at launch. According to Implicator, the count fell to 719 on October 7 after OpenAI withdrew three manuscripts because of a sign error and revised 14 others.

The claims are bold. They include a proof of the Unique Games Conjecture. This central open problem concerns how hard it is to find near-optimal answers to optimization problems such as Max Cut. The list also includes L = BPL in complexity theory, faster integer multiplication, a four-dimensional Kakeya result, progress related to the Riemann hypothesis, and a positive answer to the unitary synthesis problem that Scott Aaronson and Greg Kuperberg posed in 2007. On October 7, Aaronson wrote that no human appeared to have understood just about any of the proofs yet. An OpenAI spokesperson said many of them are not yet understood by OpenAI's own mathematicians either.

How the results were produced may matter even more. An OpenAI spokesperson told Scientific American that almost every result came from a single prompt given to a single AI agent, although some took several attempts. Decrypt reports that OpenAI says it gave the model about 4,000 problems and kept the outputs it judged significant. Each published result used about three hours of ChatGPT Pro thinking compute on average. OpenAI's September Navier-Stokes claim, by contrast, used a swarm of 10,000 agents and millions of dollars in compute. Because the model hasn't been released, nobody outside OpenAI can test the single-prompt claim.

Checking the work is the central issue, and sources disagree about how much of it has been machine-verified. Decrypt, citing the repository's own formalization catalog, says only 162 of 722 manuscripts have a main result formalized in Lean, about 22%. Lean is a programming language in which a computer checks every step of a proof. Implicator says that as of October 7, 300 of 719 top-line results, about 42%, had Lean proofs. The gap may come from fast-changing updates or from counting things differently. OpenAI itself warns that some unformalized results could have issues. Even a passing Lean check only shows that the formal statement holds. It doesn't show that the statement matches the original problem or that the result is new or important.

Mathematicians are divided. MIT's Andrew Sutherland told Scientific American that claims of one-shot solutions by a single agent should be treated as unverified until the model is released and others can replicate the results. On September 29, an advisory group at the Institute for Advanced Study asked labs to publish the model name, prompts, a reasoning summary, time and compute for every result. According to Decrypt and Implicator, OpenAI released averages and 10 reasoning summaries but no prompts. Engadget, by contrast, reported that OpenAI said it followed the group's guidelines. The Association for Human Mathematics urged mathematicians to stop working with OpenAI, while number theorist Abhishek Saha called it a very big day for mathematics.

There are practical problems too. Dana Moshkovitz, a UT Austin complexity theorist who spent years working toward the Unique Games Conjecture, said in texts Aaronson published that she could only read the claimed proof with help from AI. Decrypt notes that the repository has GitHub Issues turned off and had never accepted a pull request, so outsiders have no obvious way to submit corrections or new formalizations. Some people also worried that new mathematics could weaken encryption. Implicator reports that researcher Justin Drake described a worst-case scenario for ECDSA. OpenAI reported no attack on ECDSA or RSA, and Vitalik Buterin advised against moving wallets in a hurry.

If even some of these results hold up, the bottleneck in research moves from producing proofs to checking, understanding and crediting them. The same pattern is likely to reach law, engineering, software and science, wherever AI can produce output faster than experts can review it. Formal verification tools like Lean, and the people who can use them, become much more valuable. So do clear rules about disclosure, reproducibility and who is responsible for AI-generated claims. For now, treat the headline results as claims under active review, not as established mathematics.

Why it mattersThis would be the largest batch of AI-generated research claims so far, which makes verification, not generation, the scarce resource. How the math community handles it will set norms for AI-produced work in other fields.

At Pwn2Own Ireland 2026, the Zero Day Initiative's hacking contest that opened in Cork on October 6, AI developer tools were publicly hacked for the first time in a dedicated category. According to ZDI, 21 entries on day one demonstrated 32 unique zero-day vulnerabilities. Targets included the Samsung Galaxy S26, the Philips Hue Bridge Pro, printers, the Sonos Era 300 and a new AI Infrastructure category. ZDI's figures, as reported by Daily Security Review, put day-one payouts at $388,500. Infosecurity Magazine reported 'over $368,000'. The difference is probably due to when each outlet tallied confirmed results.

Three AI-related products were hacked on day one. ZDI says Taisic Yun of Xint combined an improper input validation bug with code injection to get a reverse shell, meaning remote control of the server, on LiteLLM. LiteLLM is a popular open-source gateway that sits between applications and many model providers, and the exploit won $40,000. A second team, Out of Bounds, also exploited LiteLLM using four bugs. Because two of those bugs were already known, the entry was ruled a partial 'collision' and earned $15,000. Ikotas Labs needed only a single argument-injection bug to exploit OpenAI's Codex cloud coding agent, also for $40,000. Tech Insider reports that VinSOC chained five bugs against Oracle's Autonomous AI Database for another $40,000.

According to Tech Insider, the new category also included Chroma, an open-source vector database, and Nvidia Dynamo, an inference-serving framework. The outlet reports AI Infrastructure payouts of $135,000 on day one and $80,500 on day two. It puts total contest payouts at more than $608,500 after two days, compared with $792,750 at the same point in 2025. Its explanation is that the new AI category spread researchers' attention across more targets. The day-two figures come from one outlet and were described as pending a final tally, so treat them as provisional until ZDI publishes official totals.

The process from here is standard. Pwn2Own gives vendors 90 days to patch the flaws demonstrated at the contest before details are published. Technical write-ups of the LiteLLM, Codex and Oracle bugs are therefore not public yet, and defenders can't know exactly which versions or settings are exposed. OpenAI can fix Codex centrally because it is a hosted service. LiteLLM and Chroma are self-hosted by many teams, who will have to upgrade on their own once fixes ship. That step is often slow, which leaves systems exposed long after a patch exists.

The choice of targets is telling. An AI gateway like LiteLLM usually stores API keys for several model providers and sees every prompt and response that passes through it, so taking over the server can expose all of that. Coding agents like Codex run commands and handle source code. Argument injection tricks a tool into treating attacker-supplied text as command options, and it is exactly the kind of bug that can turn a helpful assistant into a way in for attackers. Vector databases such as Chroma often hold internal documents used for retrieval, which makes them valuable targets too.

Some caution is needed. Pwn2Own exploits are shown under contest rules against specific product versions, and none of the sources reviewed say these bugs are being exploited in the wild. The sources also don't include vendor statements on severity or patch timelines. Security vendor Aviatrix says the results show enterprise AI platforms need stronger network segmentation and anomaly detection. That is a reasonable conclusion, but it comes from a company that sells such services. Public details on each bug will only come after patches ship or the 90-day window ends.

The bigger signal is that the software running AI systems is now a mainstream attack target. A top hacking contest is paying for it at the same level as phones and routers. Over the past two years, many teams set up gateways, vector stores and agents quickly and skipped the hardening they would apply to a database or web server. Expect more AI categories at contests like this, more CVEs (public vulnerability IDs) in AI tooling, and more customers and auditors asking for proof that AI infrastructure is patched, isolated and monitored.

Why it mattersModel gateways, coding agents and vector databases often hold API keys, source code and private documents. Hacks of them shown at a top contest mean they should be secured as carefully as any other production system.