Tech news, 8 November 2026: the Chainalysis breach widens, Palo Alto eyes agent identity, Moonshot looks to Europe for GPUs and China blocks SoftBank's robotics deal

1. Chainalysis says an agentic attack exposed credentials for all users

Chainalysis first disclosed in late October that an external actor using "offensive agentic techniques" had gained access to its systems and internal tools². On 6 November it said the investigation had found names, usernames, password hashes and live tokens exposed for all users, and it took its Know Your Transaction interface and API, address screening products and login page offline¹. The company said it still had no evidence that investigations data had been accessed¹.

CTO take: the detail that matters is "live tokens". Attackers using automation move from first access to every reachable credential quickly, so long-lived tokens turn a breach of one system into access to many. Shorten token lifetimes, bind them to clients where you can, make revoking all sessions a tested one-step action, and assume your incident response has hours, not days. If you use Chainalysis, rotate any credentials and integrations tied to it. See LLMjacking and stolen AI keys and custody architecture lessons.

2. Palo Alto Networks is reportedly in talks to buy Clutch Security

Palo Alto Networks is in talks to buy Clutch Security for around $500 million, The Information reported; no deal has been announced³. Clutch's software tracks the credentials that machines and AI agents use to reach systems, an area usually called non-human identity security⁴.

CTO take: in most companies, machine credentials already outnumber people, and agents are multiplying them. Before buying a tool, build the inventory: which agents and services hold which credentials, who owns each, and when it expires. That list is also your blast-radius map for an incident like Chainalysis's. See agentic infrastructure on giving every agent an identity.

3. Moonshot AI reportedly sought Blackwell GPUs through European data centres

Chinese AI lab Moonshot AI discussed leasing Nvidia Blackwell computing capacity from GPU cloud operators in Europe, mainly for inference, CNBC reported on 5 November, citing people familiar with the talks⁵. CNBC notes that current US rules give regulators limited authority over access to controlled chips through cloud services hosted outside China⁵.

CTO take: remote access to advanced chips is the next obvious target for export rules. If you run or resell GPU capacity, especially in Europe, know your customers and where their ownership sits, and expect stricter checks. If you buy capacity, check whether your provider's customer mix could put the capacity at regulatory risk. See what to look for in AI capacity contracts and the Europe page.

4. China blocks SoftBank's purchase of ABB's robotics business

ABB said a Chinese government agency blocked SoftBank's roughly $5.4 billion purchase of its robotics division; the deal had cleared competition review but faced a separate foreign investment security review, according to Bloomberg⁶. The Robot Report says the concern was robotics data being transferred overseas and used to train AI models, a reason other outlets have not confirmed⁷.

CTO take: data from machines in factories is increasingly treated as strategic, alongside personal data. If your products collect operational data in China, or any market with strong data security rules, design for that data to stay and be processed locally, with clear rules for what may leave. See per-market AI models and the China AI shopping assistant case study.

What I'd do this week

• List long-lived tokens and API keys in your estate and shorten the riskiest.
• Test revoking every user session and integration token in one step.
• Start an inventory of credentials held by agents and services, with owners and expiry dates.
• Check where machine and operational data from regulated markets is processed.

I am based in India, the United States and the UAE, working globally. See where I work, or analyse your challenge and bring the result to a call.