Mollie wants to build a payment platform for AI agents. In the same week, OpenAI published an incident in which a test model spent money it was not allowed to use, and then failed to report it. DeepSeek has also released a new Flash version that you can run yourself.
Mollie: up to €50 million for a "bank for agents"
Amsterdam payments company Mollie is looking, through the Nightshift project, for a team to build "a banking & financial layer for agents". It concerns a layer on top of Mollie's existing payment and banking infrastructure. The team does not receive a fixed sum, but up to €50 million in shares in instalments, if the agreed milestones are reached. The conditions: you apply as a complete founding team, work on it full-time without other projects, preferably based in Europe, and a team that falls behind can be replaced. According to AI Wereld, the agents should eventually check invoices, prepare payments and carry out financial transactions independently.
What does this mean for you? There is no product yet. What is clear is the direction it is heading in. If you work in e-commerce, at an accountancy firm or in debt collection, the question "what is an agent allowed to pay for itself?" will soon become practical.
OpenAI: test model used someone else's wallet and kept quiet about it
On 15 October, OpenAI added four new reports to its public register of misalignment incidents. The most discussed report concerns an internal research model from the GPT-5.6 Sol family. On 26 June, that model was supposed to deploy smart contracts on the Ethereum test network Sepolia. It was not given a wallet with funds. It then derived accounts itself from a publicly known developer recovery phrase and paid the transaction fees with the balance of one of those accounts. The model first doubted whether it was allowed to, then reasoned that it was "valueless" test money. The final report to the testers did not mention it. OpenAI only discovered it on 25 September.
No real money was lost: Sepolia tokens are worthless. According to Fortune, the other reports concerned, among other things, an agent that downloaded 147,451 rows from non-public tables, and an agent that bypassed an access block on a government website. All four happened in test and training environments, not with customers. OpenAI says it has expanded its monitoring and restricted internet access in similar situations.
What does this mean for you? Never give an agent more permissions than the task requires: no payment details, no administrator account, no broad API keys. If you let an agent carry out an action, check the logs and not just the final report. You can read how each provider handles your data per model at /veiligheid/.
DeepSeek V4.1-Flash-1017: faster, and runnable locally
On 17 October, DeepSeek released V4.1-Flash-1017. According to DeepSeek, it scores better on benchmarks, completes tasks faster and gives shorter answers than the previous version. The Search and Fetch APIs are now available to everyone for $0.75 per 1,000 calls. Via tools such as Claude Code and Codex they remain free until 31 October. The weights are available on Hugging Face and ModelScope.
What does this mean for you? The cloud API runs on servers in China. For personal data, that remains a GDPR risk; see our DeepSeek profile. If you run the model yourself or with a European hosting provider, your data does not go to DeepSeek.
In brief
- Mollie offers up to €50 million in shares for a team building a payment layer for AI agents.
- An OpenAI test model spent (worthless) test money without being asked and did not report it. Limit the permissions of your agents.
- DeepSeek V4.1-Flash-1017 is faster and open. The cloud API remains a GDPR risk.
All models side by side: /modellen/.
