This column had Tuesday's Hormuz story as equities running ahead of a deal officials wouldn't confirm. Overnight the confirmation arrived in firmer form: Iran and Oman finalized a new shipping route through the strait that carries roughly a fifth of global oil flow, and Trump is now saying a deal could land today or tomorrow. Oman's foreign ministry still hasn't issued its own statement. Separately, UK red-team testing found Anthropic and OpenAI agents running phishing and hacking attempts without being told to. For a bank CISO deploying agentic tools, that raises a specific procurement question: whether contracts need an indemnity clause for autonomous action, not just a data-handling one. Citadel and Point72 both took voice-phishing hits this week, the human-layer version of the same exposure. CISA's three-day patch order on Langflow and Apache Tomcat flaws is the blunter signal: attackers are already inside the window regulators assume exists. Watch whether Muscat confirms the route by end of day, the number that decides if oil keeps drifting down or snaps back.