Claude Duet, Recursive Flint, PHP2Shell Hackening

Anthropic launches Claude Duet, a proactive Opus 5.5 agent that monitors your apps and works autonomously between approval checkpoints.

Must read

Claude Duet: proactive Opus 5.5 agent — First production ambient agent from Anthropic — direct read-across for your overnight-agent-factory patterns and dispatch infrastructure thinking.
Recursive Flint: 40B MoE local coding model — 125 tok/s on M4 Pro with 2.5B active params — a credible daily-driver local coder for your Apple Silicon setup.
Claude API version 2026-10-21 released — First official versioned Claude API since 2023 — your in-house MCP servers and SDK pins need a migration plan.
Claude Code v2.1.309 — sandbox + MCP fixes — Fixes sandboxed commands modifying —mcp-config and symlink-escaping denyWrite — material for your headless agent security posture.
LiteLLM v1.107.0 PyPI compromise — Your model gateway is LiteLLM — check pins and rotate credentials. Two-hour window but the blast radius is your whole AI estate.

Tools & Frameworks

Anthropic donates Agent Skills to AAIF

Agent Skills standard moves to the Linux Foundation’s Agentic AI Foundation, following the same path as MCP earlier this year.

Why this matters: Skills are now a vendor-neutral standard worth building on long-term.

LangSmith LLM Gateway public beta

Spend caps, rate limits, model fallbacks, and PII redaction for production agents without provider lock-in.

Why this matters: Direct competitor to your LiteLLM gateway — worth benchmarking given this week’s LiteLLM incident.

JetBrains Air Governance GA

Central org layer for managing which agents, models, and providers teams use, with spend limits and usage attribution.

Why this matters: Governance pattern reference even if your team is on Cursor/Claude Code, not JetBrains.

Official OpenAI CLI

OpenAI ships a first-party CLI for the API, mirroring the Claude Code / Codex posture.

Why this matters: Another headless agent primitive — evaluate for mixed-vendor dispatch workflows.

OpenAI Decisions API

Low-cost, low-latency classification/routing endpoint for in-app decisions where a full chat model is overkill.

Why this matters: Fits the ML-tier of your three-tier architecture; candidate for cheap routing in agent pipelines.

langchain-core 1.7.0: tool-call-delta streaming

Tool-call args now stream as tool-call-delta slices rather than snapshot block-deltas; pin <1.7 to preserve old behaviour.

Why this matters: Breaking change if any of your Python agents parse raw stream events.

Open Models & Local

Ollama v0.40.9: Phonon TTS and d3 decision models

Adds local speech generation on Apple Silicon via Phonon and ships vLLM’s d3 decision models with an OpenAI-compatible /v1/audio/speech endpoint.

Why this matters: More useful primitives for the local-plus-cloud hybrid stack you’re documenting.

vLLM announces Humming quantized kernels

General-purpose kernel library for quantized inference with broad device and quantization coverage.

Why this matters: Matters for whether local coding models keep closing the gap at usable quants.

GUI-Owl 1.5: 2B on-device Android agent

2B-param screen model operates Android apps via accessibility service — reads screens, taps, types, all local.

Why this matters: On-device computer-use is a credible pattern now; relevant for identity/fraud mobile flows.

Industry & Trends

OpenAI coordinates PHP2Shell disclosure

GPT-5.6 Sol discovered critical PHP vulnerabilities (CVE-2026-109618/9); OpenAI released a checker and a framework for AI-discovered vuln disclosure.

Why this matters: LLM-driven vuln discovery is now operational — expect similar waves across your dependency tree.

Pragmatic Engineer: rethinking security post-PHP2Shell

Orosz on a month’s worth of breaches in a day and whether AI-assisted vuln hunting changes defender economics.

Why this matters: Direct implications for RegTech threat modelling and your SDLC.

OpenAI models arriving in Google Cloud Model Garden

Frontier OpenAI models and Codex workflows get native Google Cloud distribution, including Antigravity and Gemini Agent surfaces.

Why this matters: Multi-vendor routing just got easier at the enterprise tier.

OpenClaw creator burned $10M in tokens last month

Peter Steinberger describes workflows unlocked by a near-unlimited token budget at OpenAI.

Why this matters: Signal on where elite agentic workflows are heading when cost isn’t the constraint.

Sources unavailable today: Every — Chain of Thought (Dan Shipper), Last Week in AI, r/ChatGPTCoding top, r/ClaudeAI top, r/LocalLLaMA top, r/MachineLearning top

Auto-curated daily by Claude Opus 4.7 from Ben’s Bites, Don’t Worry About the Vase (Zvi), GitHub: All-Hands-AI/OpenHands, GitHub: anthropics/claude-code, GitHub: langchain-ai/langchain, GitHub: ollama/ollama, GitLab blog, Google DeepMind blog, Hugging Face blog, JetBrains AI blog, LangChain blog, Latent Space, NVIDIA developer blog, OpenAI blog, SaaStr (Jason Lemkin), Simon Willison, TLDR AI, The Pragmatic Engineer (Gergely Orosz), Tomasz Tunguz, Vercel blog. Source list and editorial profile maintained by Daniel.