Thursday, 22 October 2026

Anthropic has opened a research preview of Claude Duet, a separate app in which Claude works as a proactive agent [1]. It sends a morning brief on what needs attention across your connected apps, takes tasks by text or voice message, keeps working on its own cloud computer while you are away, and asks before it acts on your behalf [1][2]. It runs on Claude Opus 5.5, and you cannot choose another model [1][3].

Access is by waitlist, for Pro and Max subscribers in the US only; Team and Enterprise plans are not included yet [2][3]. The company says Duet is included in Pro and Max at no extra cost during the preview, but it draws on the same usage limits as the rest of Claude, and its background checks count too [3]. New entrants get one full limit reset, usable until 30 November 2026 [3]. It is on iOS, Android and the web at claude.ai [2].

Duet can use the more than 6,000 connectors and plugins in the Claude Marketplace, and it can buy things through Stripe's Link or Shopify's Shop Pay, with a one-time card per purchase [1][3]. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you the action and waits for approval [1][3]. Trading securities and moving money between accounts are off-limits even with approval [1][4]. A new classifier is meant to refuse to share credit card numbers and government ID [1][4]. Anthropic lists the limits: it checks accounts at set intervals, so urgent items can arrive between checks, you cannot watch its browser, and Microsoft 365 is not available yet [3].

Anthropic has released API version 2026-10-21, which replaces 2023-06-01, the version earlier SDKs sent with every request [1][2]. New SDK releases send it by default: Python SDK 2.0.0, TypeScript SDK 1.0.0, C# SDK 13.0.0, Go SDK 2.0.0, Java SDK 3.0.0, PHP SDK 1.0.0, Ruby SDK 2.0.0 and the ant CLI 2.0.0 [1]. Those SDK and CLI versions move from the MIT License to Apache 2.0 [1].

The breaking changes are specific. Under 2026-10-21, a request that sends temperature, top_p or top_k returns a 400 error, even at the default value [2]. Requests then sample with the defaults, including a temperature of 1.0 [2]. Anthropic says Claude 4.7 and later models already accept only the defaults, so they sample as before; on models that accept other values, such as Claude Sonnet 4.6, a request that lowered temperature for more consistent output loses that effect, and no other setting replaces it [2]. Document blocks placed directly in assistant messages and citations on text blocks in user messages also return 400 errors [2]. Several Admin API fields are renamed, and the legacy Text Completions API is removed from the TypeScript, Go, Java and Ruby SDKs and the CLI [2].

On Amazon Bedrock, the new version works only with Claude 4.7 and later models [2]. Anthropic also added fields that show whether it has restricted or banned one of your end customers, building on user profiles launched on 20 October [1]. The switch happens when you upgrade: an SDK uses the API version that was current when its major version came out, and a request that relies on a non-default temperature can stay on 2023-06-01 [2].

Amazon says its MadPot honeypots logged an attempt to exploit PHP2Shell, the pair of critical PHP flaws CVE-2026-109618 and CVE-2026-109619, on 17 October, four days before public disclosure [1][2]. The attempt came from an address on a commercial anonymization network, and Amazon says it is unclear how the attacker got exploit information during the embargo [1]. On release day Amazon found several proof-of-concept exploits and more attempts from several actors before the 14:00 UTC embargo lift; it now says PHP2Shell "is now being broadly exploited in the wild" [1].

Cloudflare's chief executive, Matthew Prince, said the company saw thousands of attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after it, and millions by Thursday, according to [2] and [3]. WatchTowr told SecurityWeek that the exploits circulating either do not work, test for timing differences or crash the target [2]. Germany's BSI and the Dutch cyber agency say they have not seen a successful attack, according to [3]. In Japan, Mizuho's bank and securities arms halted services and All Nippon Airways disabled boarding passes in Apple Wallet, according to [3].

Amazon's advice: upgrade to the fixed PHP versions, which it calls the only complete fix; consider blocking multipart file uploads if you cannot patch; look for POST requests containing PHP_SESSION_UPLOAD_PROGRESS; and start any investigation from 17 October, not from the disclosure date [1]. It also argues that AI-assisted analysis makes it cheaper to turn a patch into a working exploit, so patch timelines for internet-facing systems should be measured in hours [1].

Uber is giving ChatGPT Work, OpenAI's agent inside ChatGPT Enterprise, to more than 30,000 employees, OpenAI says [1]. The rollout follows a pilot with 1,000 employees [1][2]. ChatGPT Work connects to Google Drive, Gmail, Google Calendar and Slack, and GPT-6.1 Sol will be its default model at Uber, according to OpenAI [1]. Uber's developers will keep using Codex for software work [1].

Uber's vice-president of engineering, Sumanth Sukumar, told TechCrunch that about 80% of the pilot's early adopters were not engineers, and that they used it to analyse operations data, localise training material and build dashboards [2]. Uber has not settled exactly how employees will use the tool, according to [2]. "Our approach is to make powerful AI tools available across Uber while giving teams room to experiment," he said [2]. Earlier this year Uber paired 30 AI engineers with teams and gave them two weeks to automate parts of their jobs, he said [2].

What the deal costs is not public: Uber did not disclose its spending, according to [2]. OpenAI says the two companies will share adoption, use cases and measurable outcomes as the rollout goes on [1]. For buyers weighing ChatGPT Enterprise against other suites, the useful details are the connectors named and the plan to measure workflows before deciding how widely to deploy them, not the headcount [1][2].

DeepSeek has raised about $15 billion, roughly 100 billion yuan, according to Bloomberg, as reported by TechCrunch [1]. The Wall Street Journal also reported the round on Thursday, saying it nearly doubled its original target and that DeepSeek was valued at about $74 billion before it closed, according to PYMNTS [2]. DeepSeek did not respond to TechCrunch's request for comment [1].

The money arrives two days after the US ordered federal civilian agencies to remove DeepSeek technology from their systems, according to [1]. Potential investors include battery maker CATL and Tencent, according to [1]. The Journal reported that founder Liang Wenfeng told investors in September that the company's annualised revenue run rate had reached $1 billion, and that DeepSeek is speeding up plans for a Shanghai listing in early 2027, according to [2]. The round follows a June raise of more than $7 billion at a $50 billion valuation, TechCrunch says [1].

For businesses, the round gives the lab more money to spend while US federal civilian agencies must remove its technology [1]. If you route work to DeepSeek through a third-party provider, the question to ask is unchanged: where the model runs and who holds your data. The valuation after the round is not public.

Anthropic is donating Agent Skills, its open format for giving agents task knowledge, to the Agentic AI Foundation (AAIF) under the Linux Foundation [1]. A skill is a folder with a SKILL.md file and any scripts or reference material an agent needs [1]. Anthropic says more than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, have integrated the standard, and that 1 million skills have been published and nearly 280 million installed [1]. It is handing over the name, logo, GitHub organisation and the agentskills.io domain; engineers from Anthropic, Google, OpenAI and other companies will maintain it as individuals [1].

Agent Skills is one of four projects the foundation added on 22 October, according to [2]. The others are Open Responses, a specification from OpenAI based on its Responses API for one request and response format across model providers; OpenEnv, a framework for reinforcement-learning environments from Hugging Face; and OpenSandbox, from Alibaba [2]. That brings the foundation to 10 hosted projects, up from three at launch in December 2025, alongside the Model Context Protocol, A2A and AGENTS.md [2]. Databricks and Vercel already expose Open Responses endpoints, according to [2].

Anthropic says you can keep using or contributing to Agent Skills without joining the foundation, and the proposed roadmap covers versioned releases, a formal proposal process and security guidance for people who write and install skills [1]. A skill can carry scripts, so installing one from a stranger is closer to installing software than reading a document [1].

Recursive, the startup led by former Salesforce chief scientist Richard Socher, has released its first model, Flint, a coding model that runs on a laptop [1]. It is free on Hugging Face under the Apache 2.0 license [1][3]. Flint is a mixture-of-experts model with 40 billion total parameters, of which 2.5 billion are active per token [1][2]. The company says its automated research system, the Eureka Machine, helped with nearly every step of development, and that a small team built the model from scratch in under four months [1][2].

Recursive's own figures put Flint at more than 125 tokens per second on a MacBook Pro with an M4 Pro chip and above 150 on an Nvidia RTX Spark, roughly twice as fast as comparable models, according to [2]. It claims the lead among mixture-of-experts models under 50 billion parameters on SWE-Bench Pro v2, Terminal-Bench 2.1 and SWE-Bench Verified [2]. The Decoder notes those results have not been independently verified yet, and that dense models such as Qwen 3.8 score higher in some tests [2]. The company says Flint needs more guidance than large paid coding assistants and suggests splitting big tasks into smaller steps, according to [1].

A local model keeps code on your machine and avoids per-token fees, TechCrunch notes [1]. Recursive emerged in May with $650 million at a $4.65 billion valuation, according to [1]. How much researcher time the Eureka Machine saved is not public [1].