AI news, 22 October 2026

Claude Duet: Anthropic's proactive agent app (US waitlist only, not in the UK yet)

Mostly fact: Anthropic has opened an early research preview of Claude Duet, a separate app for iOS, Android and the web where Claude (running on Opus 5.5) sends you a morning brief from your connected apps, checks in every few hours, only messages you when something needs you, and keeps working on its own cloud computer while your phone and laptop are off. It asks before it sends, pays, signs or deletes anything, and some actions stay off-limits even with your approval, such as trading or moving money between accounts. The hype to trim: it's a waitlist for US Pro and Max subscribers only and is not available in the UK yet, it eats into your plan's usage limits, it checks every few hours rather than in real time, Microsoft 365 isn't supported yet, and Anthropic itself says it can still misjudge what's urgent.

Why it mattersIt's pitched squarely at professionals and small-business owners, with jobs like invoices, payroll prep and contracts, and it puts Anthropic in the same race as Meta's Muse for always-on assistant agents. UK readers can't use it yet, so watch what US testers report and use the wait to tidy up the apps and connectors you'd want it to see.

Sourcesx.com post ↗ · x.com post ↗ · claude.com ↗Partly fact Hype or Fact? check

• Claude & Claude Code (Anthropic)
• Claude Duet (Anthropic)

OpenAI says its models helped find a critical PHP flaw, and there's a Codex skill to check your site

OpenAI says its models, working within its 'Patch the Planet' programme, helped researchers find serious security flaws in PHP, the language behind an estimated 70% of websites, and that it spent two months with PHP's maintainers and security firms preparing a fix that needed a major change to PHP itself. It calls this one of the most impactful vulnerabilities in recent memory (its own assessment), says every PHP site can now upgrade safely, and has published a Codex skill you can point Codex at to check whether your site is affected.

Why it mattersIf your website runs on WordPress or anything else built on PHP, ask your host or developer today whether PHP has been upgraded and the recommended protections applied. Managed hosts often handle this for you, but check rather than assume.

Sourcesx.com post ↗ · x.com post ↗ · x.com post ↗

• OpenAI Developers (OpenAI Platform & Codex)

Recursive's Flint: a free coding model that runs offline on your laptop

Recursive, the AI lab led by Richard Socher, released Flint, an open-weight coding model (free under the Apache 2.0 licence) that you download and run on your own machine, and says it was largely built by its own automated research system in under four months. It claims more than 125 tokens a second on a MacBook Pro and best-in-class results for its size; those are Recursive's own benchmarks, and you'll need a well-specced machine, as the compressed version is about 23GB.

Why it mattersA capable model that runs locally means client code or sensitive data never leaves your laptop, and there's no usage bill. It's a good fit for privacy-conscious freelancers and agencies, less so if you're on a basic laptop.

Sourcesx.com post ↗ · x.com post ↗ · huggingface.co ↗

• Recursive (Flint)

Claude Security now re-scans your code every time it changes

Anthropic's Claude Security can now watch your code continuously: you connect your repositories once, it runs a deep first scan, then checks each new change so its findings stay current. It's in public beta for Claude Enterprise customers only.

Why it mattersWith AI writing more of our code, ongoing security checks matter more than ever. If you're not on Enterprise, at least run a security review before anything you've built goes live.

Sourcesx.com post ↗

• Claude & Claude Code (Anthropic)

OpenAI's models are coming to Google Cloud

OpenAI is bringing its frontier models and Codex agent workflows to Google Cloud's Model Garden, so companies that already build on Google Cloud can use them there.

Why it mattersThis mainly matters to larger firms tied to one cloud provider, but it shows the big labs now sell through each other's platforms, which means more choice for buyers.

Sourcesx.com post ↗

• Google Cloud

NVIDIA at GTC Berlin: helping agents know your business

At GTC Berlin, NVIDIA added an Agent Knowledge Foundation to its Agent Toolkit to help agents find the right business information and suggest next steps, alongside OpenShell, which controls what agents can access and do.

Why it mattersIt's developer-level news, but the message applies to everyone: agents are only as good as the business knowledge you give them, and controls over what they can touch are becoming standard.

Sourcesx.com post ↗

Railway security incident: if you host apps or agents there, rotate your keys

Railway, a popular hosting platform for apps and agents, said on 21 October that an unauthorised party may have accessed customers' stored environment variables (where API keys and passwords usually live), in some cases decrypted, and told all users to replace every variable, API key and private registry credential and check their logs. Railway believes it's part of a wider series of attacks on platform companies aimed at AI model providers and has asked those providers to revoke keys; at its last status update (23:45 UK time on 21 October) builds were still paused, so you may not be able to redeploy with new keys straight away.

Why it matters@gregisenberg's point applies whether you use Railway or not: an AI API key is effectively a credit card for compute. His 10-minute fix is to rotate your keys, set a hard monthly spending limit in each AI dashboard, give every agent its own key and switch on usage alerts.

Sourcesx.com post ↗ · x.com post ↗ · blog.railway.com ↗ · status.railway.com ↗

ElevenCreative Chimera: talking-character videos with expressive AI voices

Fact, with launch-video gloss: Chimera in ElevenCreative pairs ElevenLabs' Eleven v4 voice model with Seedance 2.5, ByteDance's video model, so you create or upload a character, write their line, pick or design a voice and direct the delivery with tags like [whispers] or [laughs]. The 'world's leading models' line is marketing: clips run 4 to 30 seconds at up to 720p, video generation needs a paid ElevenLabs plan with costs that vary by settings and length (we found no published Chimera price), and Seedance 2.5 isn't available in the US, though it is in the UK.

Why it mattersTest one paid clip before committing, and be open with your audience that it's AI-generated.

Sourcesx.com post ↗ · elevenlabs.io ↗Fact Hype or Fact? check

Firecrawl People Data: free prospect research inside ChatGPT and Claude

Fact, but the 'free' is small: Firecrawl relaunched People Data, 270M+ company and people records from three named providers (Apollo, FullEnrich and Data Legion; we couldn't confirm a '10 providers' figure) that you can search from ChatGPT, Codex or Claude, with 1,000 free credits a month and no card. Basic Apollo searches cost nothing but show masked surnames, while a full person match costs 30 credits, a work email 20 and a mobile number 175, so by Firecrawl's own maths the free tier covers about 30 matches or 50 work emails.

Why it mattersIt's fine for researching a handful of decision-makers before a pitch, not for building big lists. If you then email people in the UK, data protection law still applies to named work emails, and under the ICO's PECR guidance (currently under review) you can email limited companies without prior consent if you say who you are and offer an opt-out, but sole traders and some partnerships count as individuals and need consent first.

Sourcesx.com post ↗ · firecrawl.dev ↗ · ico.org.uk ↗Fact Hype or Fact? check

• Firecrawl
• ChatGPT (OpenAI)
• Claude & Claude Code (Anthropic)

Check what your agent skills could leak

Two security warnings about agent skills are doing the rounds: one research group says that in a sample of 17,022 skills from a public marketplace, 520 leaked credentials, mostly by accident through ordinary print or log lines, and JFrog's 2026 report, as quoted by @WebWrightAI, counted 969 malicious agent skills. These are the researchers' own figures, and we haven't seen the full reports.

Why it mattersSkills are code your agent runs with your keys. Install them only from sources you trust, skim what they do first, and keep API keys where a skill can't print them.

Sourcesx.com post ↗ · x.com post ↗

Capafy: a marketplace for selling agent skills as products

Capafy lets people turn agent skills into closed AI agent products that others can buy, and says one listed agent, CloneCut, made more than $289K in sales in 30 days; that's the company's own claim and we couldn't verify it.

Why it mattersFor trainers with a repeatable process, packaging it as a skill or agent could become a product line. Treat the revenue headline as marketing until there's more evidence.

Sourcesx.com post ↗ · x.com post ↗

• Capafy

Google's Harness²: an agent that improves its own set-up for each task

Google Research open-sourced Harness², where an agent proposes changes to its own prompts, tools, memory and skills for each task, tests them and keeps what works, without retraining the model. Google reports gains of up to 11.5 points on a workplace benchmark (WorkBuddy-Bench); those are its own results.

Why it mattersThe lesson for anyone using agents: the instructions, tools and memory around a model often matter as much as the model itself, so improve your set-up before paying for a bigger model.

Sourcesx.com post ↗

Greg Isenberg: getting your business ready for AI shopping agents (31-minute strategy talk)

Verdict: a strategy talk, not a tutorial; beginner-friendly, no coding needed.

Sourcesx.com post ↗Steps to try, cost and caveat ↗

Nidhi Singh: let Claude Code use Codex's computer use to drive Mac apps (includes a sponsored segment)

Verdict: honest and useful, but intermediate to advanced, with terminal and config-file work; background mode is Mac-only, and because it relies on an undocumented part of the ChatGPT app, an update could break it.

Sourcesx.com post ↗Steps to try, cost and caveat ↗

• Claude & Claude Code (Anthropic)
• OpenAI Developers (OpenAI Platform & Codex)

Claude Code + Obsidian: keep your agent's memory in a notes vault (likely a re-upload; credit @0xrux)

Verdict: ignore the bait, because the system itself is simple and sensible; beginner to intermediate, no coding (just Markdown notes), but you need Claude Code set up.

Sourcesx.com post ↗Hype Hype or Fact? checkSteps to try, cost and caveat ↗

• Claude & Claude Code (Anthropic)
• Obsidian

Ask your readers to make you a Google 'Preferred Source'

Google lets people choose Preferred Sources, and your content can be highlighted with a 'preferred' badge in AI Mode and AI Overviews, not just Top Stories, for anyone who has picked your site. It's one of the few AI search signals you can influence directly through your own audience. To use it, check your domain shows up in Google's source preferences tool (only whole domains or subdomains qualify, not a /blog folder) and that your site is included in Search generative AI features in Search Console, then add Google's two-line 'Add to preferred sources' button to your site or share the link google.com/preferences/source?q=yourdomain.com in your newsletter and social posts. It only helps with people who already know you and sits on top of normal ranking, so treat it as a boost, not a shortcut.

That's it for today.

Sourcesdevelopers.google.com ↗