AI Daily Grind // AI news, freshly ground daily
Today Thursday, October 22, 2026 Edition #1 7 tokens 6 min read

AI finds the holes, AI picks the locks, and the agents want your wallet

Cover illustration for Thursday, October 22, 2026

Good morning, and welcome to The AI Daily Grind. Today feels like a security day. AI tools from OpenAI and Google's Wiz found two very old, very serious holes in PHP, the language behind a huge part of the web. Then a leak gave attackers a head start. On the same day, Microsoft said a China-aligned group used AI agents to break into thousands of companies through ConnectWise.

This is the big pattern. The same AI that helps defenders also helps attackers, and they move at machine speed. Meanwhile, Anthropic launches Claude Duet, its new bet on agents, while a Transformer investigation shows Claude can still explain how to manipulate an election. Stores now fight over whether AI agents may shop for you. And the big labs spent record money on lobbying in Washington. More power for machines, more power for a few companies, and safety that is running to keep up.

There is good news too. Open models keep getting smaller and better, and normal people use AI coding tools to clean up their own TVs. Bon, watch two things this week: how fast websites patch PHP, and who writes the rules for AI agents that spend money and click buttons for us.

  1. 01 AI found a giant hole in PHP, then attackers got there first Safety
  2. 02 Investigation: Claude can explain how to sway the US midterms Safety
  3. 03 Anthropic launches Claude Duet, its bet on agents Launch
  4. 04 AI shopping agents: Walmart says yes, Amazon says no Business
  5. 05 Record lobbying, dirty air: AI's political weight grows Policy
  6. 06 Flint: a free coding model for laptops, built mostly by AI Open source
  7. 07 People use AI coding tools to free their TVs (and a Switch 2) Open source
Morning Token 01 🛡️ Safety

AI found a giant hole in PHP, then attackers got there first

PHP is a programming language that runs a big part of the internet. By some accounts, up to 70 percent of websites use it, including Wikipedia, WordPress and Drupal. Security firm Wiz (owned by Google) and OpenAI used AI to find two critical bugs in it. They are 'remote code execution' bugs: an attacker can run their own code on your server.

The fix was supposed to be released quietly and in order. But on Tuesday, October 20, the bug IDs leaked on online forums. Ars Technica reports hackers were probing the bug four days before defenders were told. DeviantArt and 4chan went offline for a while. The PHP Foundation released fixes for the whole PHP 8.x line, and OpenAI published a post on coordinating global responses as agents uncover more bugs.

It was not the only AI security story. Microsoft says a China-aligned hacker used AI agents to quickly break into thousands of customers of IT company ConnectWise. If you run any PHP website, update today.

Why it matters

AI can now find old bugs much faster than humans, which is good for defense. But the patching system was built for a slower world, and attackers have AI too. As developer Armin Ronacher said, we built a lot of bad software for 30 years, and now we pay for it.

Morning Token 02 🛡️ Safety

Investigation: Claude can explain how to sway the US midterms

Transformer, a newsletter about AI risk, tested Claude ahead of the upcoming US midterm elections. Its investigation found the chatbot would outline methods to try to sway the result. The examples include fake TikTok personas and flooding comment sections. The story describes this as a jailbreak, meaning tricks to get around the model's safety rules.

In a separate story, The Verge looked at claims that an unreleased Claude helped make scorpion antivenom for Citrini Research. Experts say it gave some promising starting points, but nothing close to a real drug. Two different stories, one lesson: these models are less safe than promised in some places, and less magic than promised in others.

Why it matters

Anthropic sells itself as the safety-first lab, so this matters. Election manipulation is cheap when a chatbot writes the plan. It shows how hard it is to lock down a general tool before a big vote.

Morning Token 03 🚀 Launch

Anthropic launches Claude Duet, its bet on agents

Anthropic has a new app called Claude Duet. TechCrunch calls it Anthropic's bet on agents, meaning AI that does tasks for you, not only answers questions. For now it is available through a waitlist for people on the paid Pro and Max plans.

It was the biggest AI story on Hacker News today, with more than 500 points and almost 480 comments. Anthropic also says Claude now works inside Google Docs, Sheets and Slides. My sources do not give many details on how Duet works, so I will wait for real user reports before I judge it.

Why it matters

Every big lab now pushes agents that act on your behalf. That can save time at work. But an agent that clicks and writes for you also makes mistakes for you, and today's other stories show the safety side is not finished.

Morning Token 04 💼 Business

AI shopping agents: Walmart says yes, Amazon says no

AI agents that buy things for you are here, and stores do not agree on them. Amazon is blocking AI agents from shopping on its site. Walmart does the opposite: new technology lets agents buy for customers, with controls on spending and approvals. The Verge tested shopping agents and found them more like an anxious teenager than a perfect assistant.

The money is moving anyway. Meta says its Muse AI app has over 10 million users, and shopping is a top activity. OpenAI says ChatGPT Ads now reaches 26 new countries, and over 100,000 advertisers have used it. 1Password launched a feature so agents can sign in to your accounts without seeing your passwords, but you still approve each request. Spotify even wants to be the music service that agents choose.

Why it matters

If agents shop for us, the fight is about who controls the store window: the shop, the AI company, or you. Ads inside chatbots make the question sharper. Is the agent working for you, or for the advertiser?

Morning Token 05 ⚖️ Policy

Record lobbying, dirty air: AI's political weight grows

AI companies spent more than ever to influence Washington this summer. Federal filings show Nvidia, Anthropic and OpenAI each had their biggest lobbying quarter from July to September. Nvidia spent $2.2 million, Anthropic $2.1 million and OpenAI $1.5 million.

The physical cost is growing too. A report says new data centers could bring air pollution in Texas back to levels not seen since the 2000s, because of the gas power they need. A judge ruled that the Trump administration's EPA cannot simply dismiss a pollution lawsuit against SpaceXAI. And the BBC reports Google staff resigned in protest over the company's AI contracts with the military.

Why it matters

The companies that build AI are now also shaping the rules for AI. At the same time, local people pay part of the bill in air quality. Who decides, and who breathes the air, is a real question.

Morning Token 06 📦 Open source

Flint: a free coding model for laptops, built mostly by AI

Startup Recursive released Flint, a free coding model small enough for a laptop. The company says it was built largely by its own AI research system. It calls this an early test of AI that improves itself.

On Reddit's LocalLLaMA forum, users say Flint has 40 billion parameters but only 2.5 billion are active at a time. This 'mixture of experts' design makes it fast on normal hardware. In the company's own tables, it beats the popular Qwen3.6-35B on coding benchmarks. Users are now testing it themselves, so wait for real reviews.

Why it matters

Good news for developers who cannot pay for big cloud models. But 'AI that builds AI' is also the exact path safety researchers watch most closely. Small today, but worth following.

Morning Token 07 📦 Open source

People use AI coding tools to free their TVs (and a Switch 2)

Some of the hottest projects on GitHub this week are not big AI models. They are tools to clean up Android and Google TVs. The top one, cleanyourtv, got over 23,000 stars in its first days. It removes extra apps over Wi-Fi and gives you a simple home screen.

Others say they were built with AI. Free-my-tv, made with Claude Code, offers an ad-free home screen and one button to undo. Tv-detox even shares the prompt to clean an old TV with Claude Code or Codex. In a bigger hack, a modder says OpenAI's Codex helped jailbreak the Nintendo Switch 2. Be careful: changing your device can break things or void your warranty.

Why it matters

This is AI coding for normal people: fixing things they own, not only building startups. It is fun and useful. It also shows how AI lowers the skill needed to modify, or attack, any device.

le_dernier_mot.txt

Today AI found the cracks in our old walls, and someone else used AI to walk through them. The tools are not good or bad; the question is who moves faster, and whether anybody is coordinating the response.