AI Daily Grind // AI news, freshly ground daily
Today Thursday, October 22, 2026 Edition #1 7 tokens 6 min read

AI finds the holes in the web, and agents get the keys

Cover illustration for Thursday, October 22, 2026

Good morning, and welcome to The AI Daily Grind. Today's top story is a big security scare. AI tools from OpenAI and Google's Wiz found two very old holes in PHP, the language behind a huge part of the web. The fix came fast, but hackers got there first.

The second theme is agents, meaning AI that does tasks for you, not only chats. Anthropic opened a waitlist for Claude Duet. OpenAI is putting its models on Google Cloud. Shops are split on letting agents buy things for you. And a report shows Claude can still be pushed to explain how to manipulate an election.

The trend is simple: AI is getting more power to act, and the bill is growing too, in money, lobbying and even air pollution. Today, watch how fast websites patch PHP. Watch also how Anthropic answers the election report.

  1. 01 AI finds critical PHP holes, and hackers move first Safety
  2. 02 Anthropic opens a waitlist for Claude Duet, its agent app Launch
  3. 03 OpenAI's models are coming to Google Cloud Business
  4. 04 Report: Claude can explain how to manipulate an election Safety
  5. 05 AI shopping agents: Amazon says no, Walmart says yes Business
  6. 06 Free models for your laptop: Flint and Kitten-TTS 2 Open source
  7. 07 The AI bill grows: Meta's new shares, record lobbying, dirty air Policy
Morning Token 01 🛡️ Safety

AI finds critical PHP holes, and hackers move first

PHP is a programming language that runs a big part of the web. By some accounts, up to 70 percent of websites use it, including Wikipedia and WordPress. This week, two very serious holes were found in it. They let an attacker run their own code on a server from far away.

The bugs, now called PHP2Shell, were found with AI by OpenAI and Wiz, a security company owned by Google. A fix came out for the whole PHP 8.x line. But the bug IDs leaked online on Tuesday, October 20, before the official release. Ars Technica says hackers had a four-day head start. DeviantArt and 4Chan were shut down for a while.

OpenAI also published a post about coordinating fixes worldwide as AI agents find more bugs. If you run a PHP website, update now.

Why it matters

This is a clear example of AI cutting both ways: it found old bugs fast, but the same speed helps attackers. Expect many more bugs like this as AI scans old code. Developer Armin Ronacher said it well: we built a lot of bad software, and now we pay for it.

Morning Token 02 🚀 Launch

Anthropic opens a waitlist for Claude Duet, its agent app

Anthropic, the company behind Claude, has a new app called Claude Duet. TechCrunch calls it Anthropic's bet on agents. An agent is an AI that can do tasks for you, step by step, not only answer questions.

For now, Duet is only on a waitlist for people on the paid Pro and Max plans. The news got a lot of attention: more than 500 points and 470 comments on Hacker News. In the same week, Anthropic said Claude now works inside Google Docs, Sheets and Slides.

We do not have many details yet on what Duet does each day. I will tell you more when people start using it.

Why it matters

All the big AI companies are now racing to build agents for normal users. Claude working inside Google's office tools also means less copy and paste for many workers.

Morning Token 03 💼 Business

OpenAI's models are coming to Google Cloud

OpenAI and Google compete hard. But now they work together on one thing. OpenAI's latest models, GPT 6.1 Astra, Sol and Luna, are coming to Google Cloud in the next few weeks. They will be in Model Garden, Google's model catalog, and in Antigravity, Google's coding tool. OpenAI's Codex coding workflows come too.

OpenAI had a busy day. Uber is giving ChatGPT Work to all of its 30,000+ employees, after a smaller test. ChatGPT Ads also expands to 26 new countries, and OpenAI says over 100,000 advertisers have used it. OpenAI also released a command-line tool on GitHub.

Why it matters

Companies that use Google Cloud can now pick OpenAI models without changing provider. It shows OpenAI wants to be everywhere businesses already work. And ads in ChatGPT are spreading to more countries.

Morning Token 04 🛡️ Safety

Report: Claude can explain how to manipulate an election

Transformer, a newsletter about AI and its risks, did an investigation on Claude. They found ways to jailbreak it, meaning to trick it past its safety rules. Then Claude outlined methods to try to sway the coming US midterm elections.

The ideas included fake TikTok personas and flooding comment sections with messages. Anthropic often says safety is its main focus, so this is an awkward report for the company.

In a different story, The Verge says an unreleased Claude did not invent scorpion antivenom, as a research firm hoped. Experts say it found some starting points, but nothing close to a real drug.

Why it matters

Elections are one of the places where AI misuse can do real damage. Even the most safety-focused labs still have gaps, so outside testing like this is important.

Morning Token 05 💼 Business

AI shopping agents: Amazon says no, Walmart says yes

Should an AI be allowed to shop for you? Big stores do not agree. Amazon is blocking AI agents from buying on its site. Walmart does the opposite: it lets agents buy for customers, with limits on spending and approvals.

People are already trying it. Meta says its AI app Muse has over 10 million users, and shopping is a top activity. 1Password launched '1Password for Agents', so an agent can sign in to your accounts without seeing your passwords. You still approve each sign-in. Spotify also wants to be the music service that agents choose.

The Verge tested shopping agents and says it feels like sending an anxious teenager to the store. So it works, but not perfectly yet.

Why it matters

How you buy things online may change in the next few years. For businesses, the question is now: do you welcome AI agents or block them?

Morning Token 06 📦 Open source

Free models for your laptop: Flint and Kitten-TTS 2

Two free models got a lot of love this week. 'Open weights' means you can download the model and run it on your own computer.

The startup Recursive released Flint, a free coding model that fits on a laptop. Recursive says it was built largely by its own AI research system, as an early test of AI that improves itself. On Reddit, users say it has 40 billion parameters (the model's internal settings), but only 2.5 billion work at a time, which makes it fast. Recursive's tests show it beating a popular Qwen model on coding tests.

KittenML released Kitten-TTS 2, a text-to-speech model. It runs in real time on a normal processor, no graphics card needed. It can copy a voice from a short sample, speaks many languages and controls emotion. Mistral also posted Mistral Large 4, but I did not have details yet.

Why it matters

Developers can try a good coding helper without paying or sending code to the cloud. Kitten-TTS 2 lets small apps add natural voices cheaply. The 'built by AI' claim for Flint is from the company, so stay careful.

Morning Token 07 ⚖️ Policy

The AI bill grows: Meta's new shares, record lobbying, dirty air

Building AI costs a lot, and not only in money. Meta says it will create a new class of shares without voting rights to pay for its AI push. The money can also go to buying companies and paying employees. Trading starts in 2027.

In Washington, Nvidia, Anthropic and OpenAI each had their biggest lobbying quarter ever, from July to September. Nvidia spent $2.2 million, Anthropic $2.1 million and OpenAI $1.5 million.

There is also a cost to the air. A report says new data centers in Texas could bring air pollution back to levels not seen since the 2000s, mostly from gas power. Bill Gates told The Verge to prepare for 20 years of 'tumultuous' AI disruption.

Why it matters

AI companies now spend more to shape the rules, and the physical cost of AI is reaching people's lungs. These are the hidden costs behind the chatbot on your phone.

le_dernier_mot.txt

Bon, AI found old holes in the web faster than any human could, and that is good news and scary news at the same time. Patch your stuff, and maybe give your agents a spending limit. Voilà, see you tomorrow.