Agents of Work
Let's Talk
October 22, 2026 · Agents of Work

Agents of Work AI Daily Briefing — October 22, 2026

Summary

AI found two serious holes in PHP, the language behind most of the web, and every small business with a WordPress site now has a patch to confirm with its host. The same day brought a poisoned AI developer tool, a proactive Claude agent that can buy things, and Walmart opening its store to shopping agents while Amazon shuts them out.

Highlights

  • If your website runs WordPress or other PHP software, ask your host today whether it is on PHP 8.5.12 or another patched release.

  • The PHP holes sat unnoticed for about 20 years; AI found them, and AI will also make them easier to attack.

  • A poisoned LiteLLM release stole cloud and AI passwords for about two hours; pin software versions instead of taking "latest."

  • Stolen Google Cloud logins ran up Gemini bills of tens to hundreds of thousands of dollars in a day or two, so set budget alerts now.

  • Claude Duet checks your apps every few hours and asks before it sends, pays, signs or deletes anything.

  • Walmart now lets approved AI agents shop for customers with spending limits, while Amazon is blocking them.

  • Meta's Muse passed 10 million users, and shoppers using it averaged more than $200 a purchase.

  • Tesla started building Optimus robots, but Elon Musk says the design still has to stop wearing out within a month.

Quick Takes

  • A free coding model that runs on a laptop. Recursive released Flint, a 40-billion-parameter model that activates 2.5 billion at a time and runs at more than 125 tokens per second on an M4 Pro MacBook Pro, with weights under the Apache 2.0 license. Recursive says its own automated research system did much of the building in under four months, and admits Flint needs complex jobs broken into smaller steps with explicit instructions. For a business that cannot send code to an outside service, it is a no-fee option worth testing. Read more

  • Databricks gives agents a memory. Agent Memory, now in beta, stores conversation history, user preferences and saved workflows in a company's own Databricks database. In Databricks' internal tests, agent pass rates roughly tripled and usage fell 31%; one follow-up question went from 11 tool calls and nearly six minutes to 2 calls and 41 seconds. Developers can read, export and delete what an agent remembers about each user. Read more

  • Managers say AI made their jobs harder. A Nielsen survey of 1,700 directors and senior managers in seven countries, commissioned by Monday.com, found more than half say AI makes employees' work harder to evaluate, and nearly half spend more time reviewing output. Fifty-eight percent expect to oversee more AI agents than people within a year, and 46% worry about losing control of what those agents do. Read more

What's Covered in Featured News

  • The PHP emergency: what the two flaws do, who found them with AI, which versions fix them, and why the patch took two years.

  • A bad day for the software supply chain: the LiteLLM release that stole credentials, and the phishing scheme that billed victims for Gemini.

  • Claude Duet: what Anthropic's proactive agent watches, what it buys, and what it will not do.

  • Shopping agents get a door and a wall: Walmart's Agent Gateway, Amazon's blocking, and Muse's 10 million users.

  • DeepSeek's $15 billion round: who is investing, at what valuation, and the path to a listing.

  • Salesforce buys Braze: the price and what it means for customer messaging tools.

  • Physical AI: Tesla's Optimus production start, Agility's Digit 5 timeline, Enact's sense of touch and Korea's ROBEX show.

Featured News

AI found two critical holes in PHP, and the fix is on you

PHP, the programming language behind roughly 70% of websites, including every WordPress site, shipped emergency patches on October 21 for two flaws that let an attacker run their own code on a web server. The NSA warned that any site that cannot be patched immediately should be taken offline until it can, and Reuters reported government websites around the world going dark while they updated. The flaws have existed in every PHP version since PHP 5, released in 2004.

The PHP Foundation's account explains what went wrong. CVE-2026-109618 corrupts memory when a request hits PHP's memory limit at the wrong moment; on Apache with mod_php, an unauthenticated request can trigger it before the site's own code runs, and full remote code execution was shown with default settings. CVE-2026-109619 lets a later request reuse memory left over from an earlier one. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older get no fixes at all.

AI did the finding. Calif, a security testing firm working in OpenAI's Patch the Planet program, used GPT-5.6 Sol; its researcher reported the core problem on August 11. Wiz found more using its own Wiz Atlas agent with Gemini 4 Argon and GPT-5.6 Sol, and OpenAI reported further attack routes on September 18. But the root problem was first flagged in a 2024 audit, and the Foundation is blunt that "the delay was a structural failure," caused by a consensus-based decision process and too little money. The release was also rushed: the vulnerability IDs leaked a day early, Calif mistakenly posted a video of its proof of concept, and Chainguard published fixed images six hours before the embargo lifted.

There is one piece of good news and one warning. No working exploits were identified at release, and OpenAI says the researchers got there before criminals did. But Wiz cautions that language models "can help adapt an exploit to different PHP versions," so the gap between disclosure and attack will be short. The circulated severity score of 10.0 was wrong, the Foundation says; the real score is 9.2, which is still critical. WordPress says the problem is not WordPress-specific: site owners have to get their servers patched, which usually means asking the host.

A bad day for the software supply chain

LiteLLM, a popular open-source tool that routes a company's requests to many AI providers, was compromised on October 21. A malicious version 1.107.0 sat on the PyPI package index from 11:39 to about 13:23 UTC, and poisoned Docker images, including the "latest" tag, were live until 14:20. The payload stole credentials and loaded remote-access tools. LiteLLM's write-up says the attacker had three sets of developers' GitHub credentials, used an organization owner's to switch off branch protections, and pointed the release process at a lookalike repository. One contributing detail: Claude Code sometimes embedded a user's GitHub token in response bodies, which then turned up in LiteLLM's logs. Anyone who installed an unpinned version in that window should assume compromise, rebuild from scratch and rotate every key the machine could reach.

Separately, Wiz's incident team described attackers buying Google search ads for terms like "google cloud," sending administrators to a fake login page that captured passwords and multifactor codes, then attaching their own projects to the victim's billing account. Within 24 to 48 hours, victims saw tens to hundreds of thousands of dollars in Gemini usage they could not even inspect, because the work ran in the attackers' projects. The attackers also demoted the real billing admins to read-only so they could not cut access.

Claude Duet: an assistant that messages you first

Anthropic introduced Claude Duet, a research-preview app built on Claude Opus 5.5 and aimed explicitly at professionals and small business owners. It sends a morning brief on what matters across connected apps, checks them every few hours, and messages you when something needs attention. It runs on its own cloud computer with its own browser, so your laptop does not need to stay on, and it can draw on more than 6,000 connectors, including Gmail, Slack, QuickBooks, Gusto, HubSpot, Docusign and Shopify.

The guardrails are the operator-relevant part. Duet reads and drafts on its own, but before it sends a message, makes a payment, signs a document or deletes anything, it shows exactly what it will do and waits. Purchases go through Stripe's Link wallet with a virtual card or Shopify's Shop Pay, and it cannot trade securities or move money between accounts even with approval. Anthropic concedes it may misjudge urgency and is weaker at personal errands than work tasks. It is waitlist-only for US Pro and Max subscribers, and its background checks count against the plan's usage limits. One tester, Amin Ebrahimi, who owns the roughly 110-employee Shahs of Kabob, uses it across accounting, customer support and marketing.

Shopping agents get a door at Walmart and a wall at Amazon

Walmart launched Agent Gateway, a connection point that lets approved AI assistants search Walmart and Sam's Club inventory and buy on a customer's behalf. Starting next month, each agent gets its own profile in the customer's account, with purchases shown separately, and the customer chooses whether every purchase needs approval or the agent can buy within a set spending limit. Walmart says agents never see payment details, its normal returns process applies when an agent gets it wrong, and agents that break its terms will be blocked. No Walmart+ membership is required. Amazon, by contrast, has begun blocking AI agents from buying on Amazon.com.

The demand is real. Meta said on its earnings call that Muse has passed 10 million users, about a quarter of those who set it up use it daily, and shoppers using it averaged purchases of more than $200. Meta plans to keep Muse free for most people and take a percentage of what it sells. Mark Zuckerberg described a future where buying means talking to a business's agent rather than visiting its website.

DeepSeek is wrapping up a $15 billion round

DeepSeek, the Hangzhou lab whose cheap open models rattled US competitors, is close to closing a round of about 100 billion yuan, roughly $15 billion, Reuters reported, citing four people with knowledge of the matter. The original target was 50 billion yuan. Sources put the pre-money valuation at 500 billion yuan; the post-money figure was not reported. CATL and Tencent are among the biggest investors, joined by Geely, Meituan, Midea, NetEase and more than a dozen others. DeepSeek raised $7.4 billion in June and has hired CITIC Securities for a possible STAR Market listing. The round follows the US order removing DeepSeek technology from federal agencies, which we covered on October 20.

Salesforce agrees to buy Braze for $5.66 billion

Salesforce signed a deal to acquire Braze, the customer-messaging platform used by about 2,770 companies including Canva, Dairy Queen and Venmo, for $47.50 a share in cash and an enterprise value of about $5.66 billion. Braze coordinates personalized messages across apps, email, text and WhatsApp, and Salesforce plans to fold it into Marketing Cloud and its Agentforce agents. The deal is expected to close in Salesforce's fiscal 2028, pending shareholder and regulatory approval. If Braze is one of your tools, expect pricing and packaging to move toward Salesforce's bundles over the next year or two.

Physical AI

Tesla started production of its Optimus humanoid in a former car space at its Fremont, California, factory, calling them the "first production-quality bots that we have manufactured." Elon Musk called it early production with a slow and "somewhat bumpy" ramp, and repeated a claim of 20,000 robots a week by the end of 2027. His caveats matter more to a buyer than the target: the design still needs work to be safe and reliable so the robot does not "wear out after a month," and significant AI work remains before it is useful for open-ended tasks. No price was given. Tesla's third-quarter net income fell 43% to $787 million, which the company tied partly to spending on AI and Optimus, and its self-driving chief now expects to enable unsupervised driving on some customer cars around the second quarter of next year, later than Musk's earlier forecast.

Agility Robotics, which says its Digit humanoid is commercially deployed today, set a firmer timetable for its next model. Digit 5 will standardize on Nvidia's IGX Thor computer and fold Nvidia's Halos safety models into its human-detection system, with early access in the first half of 2027 and general availability by the end of that year. Final third-party safety certification is still pending, and Agility gave no price or payload. It cites more than 65,000 hours of real-world operation for Digit overall.

In Zurich, Enact Intelligence came out of stealth with a $30 million pre-seed round from redalpine, Notion Capital and firstminute capital, with Mistral's Arthur Mensch and Yann LeCun among the angels. Founder Manuel Yves Galliker, who led software for 1X's NEO humanoid, is betting robots can sense force through their own motors, the way people feel muscle tension, rather than through touch sensors he says are too costly and fragile for factories. Enact is in talks with European manufacturers, retailers and food processors for first deployments.

South Korea's ROBEX show in Daegu, running through October 24, has 65 companies across 220 booths. HD Hyundai Robotics showed a dual-arm robot built to grow into an industrial humanoid, with each arm lifting up to 7 kilograms within a 630-millimeter reach, and Doosan Robotics showed a mobile robot that recognizes objects and works while moving. For an operator, those are the numbers to compare against your own heaviest part and narrowest aisle, and a delivery date in 2027 with certification still pending is a planning input, not a purchase order.

What This Means for Your Business

Confirm your PHP version today. If your website runs WordPress, WooCommerce, Drupal, Magento or anything else built on PHP, send your host or web developer one question: are we on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and if not, when? If the answer is 8.1 or older, you are on software that will never get this fix, and an upgrade needs to be scheduled this week, with a backup and a test of your forms and checkout afterward. A free firewall plugin will not substitute for the server patch. Discovery by AI means more of these are coming, so make "who patches our server, and how fast" a line in your hosting contract.

Pin your software and watch your cloud bill. The LiteLLM attack only reached people who pulled whatever was newest during a two-hour window. If you or a contractor runs AI tools in-house, insist on fixed version numbers, keep API keys out of the machines that install new packages, and know how to rotate every key in an afternoon. If you have a Google Cloud, AWS or Azure account with AI services turned on, set a budget alert and a hard spending cap today, make sure at least two people hold billing admin rights, and never reach your cloud console through a search ad.

Try a proactive agent on low-risk work first. Claude Duet's design, read and draft freely but ask before sending, paying, signing or deleting, is a sensible template whatever tool you use. Start it on a calendar and inbox triage, check its morning brief against your own read for two weeks, and only then connect your accounting or payroll apps. Remember that its checks consume your plan's usage, so a heavily connected account may hit limits sooner.

Make your store readable by agents, or decide not to. Walmart and Meta are betting that customers will send software to shop, and Amazon is betting it can keep them out. If you sell online, check whether your platform offers an agent-facing catalog or checkout and what spending controls it gives buyers. If you buy for the business through agents, give each one its own profile and limit, the way Walmart's model does, so you can see and cap what it spent.

Sources

← All posts