Morning edition — Thursday 22 October 2026

Recursive, the start-up led by former Salesforce chief scientist Richard Socher, released its first model, Flint, on 21 October. It is a mixture-of-experts model with 40 billion parameters, of which 2.5 billion are active per token, built for agentic coding on local hardware. TechCrunch reports it is free to download on Hugging Face under the Apache 2.0 licence.

Recursive says Flint leads mixture-of-experts models under 50 billion parameters on agentic coding benchmarks including SWE-Bench Pro v2, Terminal-Bench 2.1 and SWE-Bench Verified, and generates more than 125 tokens per second on an M4 Pro MacBook Pro. It supports contexts of up to 512,000 tokens, with 256,000 recommended.

The company says its automated research system, the Eureka Machine, helped with nearly every part of building the model, from data and training recipes to inference, letting a small team build it from scratch in under four months.

Anthropic announced Claude Duet on 21 October: a separate app, on iOS, Android and claude.ai, in which Claude acts as a proactive agent. Access is by waitlist, starting with Pro and Max subscribers in the United States, and the preview shares the usage limits of the rest of a Claude plan.

Anthropic says Duet is built around Claude Opus 5.5. It sends a short morning brief on items across the user's connected apps, checks those apps every few hours and messages the user when something needs attention. It runs tasks on its own virtual machine with a browser, so the user's laptop or phone does not need to stay on, and it can use more than 6,000 connectors and plugins from the Claude Marketplace.

Before it sends a message, makes a payment, signs a document or deletes anything, Duet shows the planned action and waits for approval. Anthropic says some actions, such as trading securities or moving money between accounts, are blocked even with approval, and that a new classifier rejects requests to share the most sensitive information, such as card numbers and government ID.

Microsoft Threat Intelligence reported on 21 October that Storm-0940, a group it describes as China-state aligned, has since at least September used ARTEX, an open-source penetration-testing framework built from AI agents, to automate attacks on hundreds of organisations worldwide. Sectors named include defence, energy, finance, government, semiconductors and software.

Microsoft says several attacks gave the group privileged access to cloud infrastructure, in multiple cases less than three hours after targeting began. It assesses that Storm-0940 was behind the ConnectWise supply-chain compromise disclosed on 16 October; after that intrusion, it says, the group used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants at 2,900 attempts per minute, abusing applications that already had access.

Microsoft says the activity did not come from a compromise of or vulnerability in its own systems, and that a successful sign-in does not necessarily mean customer data was taken. It advises customers to review service-principal sign-ins and unexpected changes to application credentials or privileges.

Walmart announced on 21 October an Agent Gateway, a server using the Model Context Protocol, through which approved AI agents can search its online inventory and buy on a customer's behalf, for both Walmart and Sam's Club, TechCrunch reports. Chief executive John Furner presented it at the Masters of Scale Summit in San Francisco.

Agent Profiles, rolling out next month, give each agent its own profile in a customer's account so its purchases appear separately; customers can require approval for every order or set a spending limit. Walmart also published terms for agents: they may not act beyond what the shopper intends or access payment information, normal returns apply when an agent misbehaves, and agents that break the rules will be blocked.

The move contrasts with Amazon, which TechCrunch notes has begun blocking AI agents from buying on behalf of shoppers.

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Its advisory says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk for mod_php. It also published minimal source backports for the unsupported 7.4, 8.0 and 8.1 branches.

Wiz Research, part of Google, says it found the first bug on 19 August using its Wiz Atlas tool, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, reported it to PHP on 24 August, and demonstrated pre-authentication code execution on WordPress, Drupal and Joomla. It says every PHP version going back to 5.4 is affected by at least one of the bugs, which it nicknamed PHP2Shell.

OpenAI says the security firm Calif found one of the flaws with GPT-5.6 Sol under its Patch the Planet initiative, that Wiz found both independently, and that it spent two months coordinating maintainers, security providers and US government agencies before disclosure. It proposed a five-stage framework for handling such findings and committed $1 billion in subsidised access to its Daybreak security programme for under-resourced defenders.

The Next Web reports that PHP brought the release forward from its planned 14:00 UTC slot after details leaked, and that CERT-EU and Britain's NCSC advised taking systems offline where they could not be patched at once. TechTarget reports that Palo Alto Networks counted more than 22.6 million exposed instances potentially vulnerable.

Meta reported third-quarter revenue of $64.60 billion on 21 October, up 26 percent from a year earlier, while costs and expenses rose 68 percent, including a $9.89 billion charge for its settlement with US state attorneys general. It narrowed its 2026 capital spending forecast to $135 billion to $145 billion, from $130 billion to $145 billion.

Its board approved a new class of publicly listed, non-voting Class C common stock, effective in January 2027. On the earnings call, chief financial officer Susan Li said the shares would be distributed to existing shareholders as a stock dividend and could be used for capital raising, employee pay and acquisitions while preserving existing voting power, TechCrunch reports.

Chief executive Mark Zuckerberg said more than 10 million people in the US and Canada had set up Muse personal agents in about a month and a half, that about a quarter of those who set it up use it daily, and that Meta expects to make Muse more than 10 times cheaper to run within a year.

Flapping Airplanes, an AI research lab founded about a year ago by Aidan Smith and brothers Asher and Ben Spector, raised a $1 billion Series A co-led by Index and Lux at a $6 billion valuation, TechCrunch reported on 21 October. Nine months earlier its $180 million seed round valued it at $1.5 billion.

The lab aims to train large models with far less data. Its founders describe a megakernel framework that can run training and inference in a single GPU program, overlapping memory-heavy and compute-heavy work so chips sit idle less often. Sequoia, GV, Kleiner Perkins and Nvidia are among its backers.