Today's Headlines

  • OpenAI models and Codex come to Google Cloud, purchasable against Google Cloud spend commitments
  • Autonomous AI pentesting tool ARTEX was used against about 20 Japanese companies, GMO's IERAE finds
  • Anthropic launches Claude Duet, a proactive agent, as a research preview for US Pro and Max subscribers
  • Critical PHP flaws found with AI get fixes, and OpenAI expects similar findings to rise sharply

The day's thread is AI that goes out to meet people. OpenAI announced that its frontier models and Codex are coming to rival Google Cloud, and Anthropic released an agent that flags what matters and gets work done before it is asked.

On the attack side, a Japanese security firm found that about 20 Japanese companies had been targeted with a tool that uses AI to carry out intrusions on its own. The attack infrastructure focused almost entirely on Japan.

Today's Top Three

OpenAI models and Codex come to Google Cloud, purchasable against Google Cloud spend commitments

OpenAI and Google Cloud announced on October 21 a partnership that brings OpenAI's frontier models and Codex's agentic workflows into Google Cloud's Model Garden.

Google Cloud customers will be able to buy OpenAI models through Model Garden, with transactions handled by the Google Cloud Marketplace. Companies with Google Cloud spend commitments can draw those commitments down for the purchases.

OpenAI models will also arrive soon in Antigravity, Google's agent-driven coding tool, and in Gemini Agent, Google's AI agent. General availability is planned in the coming weeks. According to Ars Technica, Google has begun rolling the models out in private preview to select enterprise customers.

OpenAI's announcement states that Microsoft remains its primary cloud partner. In June, OpenAI also began letting customers use its models and Codex through their Oracle cloud commitments.

Autonomous AI pentesting tool ARTEX was used against about 20 Japanese companies, GMO's IERAE finds

A series of intrusions aimed at Japanese companies used ARTEX, a system that runs penetration tests autonomously with AI, according to a report published on October 19 by GMO Cybersecurity by IERAE, the security arm of Japan's GMO Internet Group.

According to ITmedia AI+, the attack infrastructure IERAE examined targeted Japan almost exclusively. It was aimed at about 20 companies, nine of them sites in the same industry, and IERAE says the campaign may have been narrowed by country and by sector.

IERAE found six more AI-driven attack servers aimed only at Japanese companies. Among the companies it confirmed as targets, eight had published data-breach notices in September or October. IERAE says this points to one group behind multiple incidents and has shared the findings with law enforcement.

The firm named three gaps in defenses. First, versions not listed in a CVE can still be affected, and versions past end of support receive neither vulnerability notices nor patches.

Second, attack surface management (ASM) looks at systems from the outside, often cannot read version numbers, and so may not justify an emergency patch. Third, the attackers got around web application firewalls (WAFs): they switched IP addresses just below rate-limit thresholds and used several hundred addresses in total.

CrowdStrike reported on October 7 that ARTEX was used in a campaign against South Korean financial organizations from late September to early October. It describes ARTEX as an open-source agentic penetration testing tool developed in China and found that the operation relied mainly on a DeepSeek model. IERAE believes Japanese companies are being hit with the same methods.

Anthropic launches Claude Duet, a proactive agent, as a research preview for US Pro and Max subscribers

Anthropic on October 21 released Claude Duet, an agent that works on a user's behalf and reaches out only when something needs them, as a research preview.

Each morning, Claude Duet sends a brief on the items that need attention across a user's connected apps. Tasks handed to it by message run on its own computer in the cloud, using those apps, and it gets back in touch when the work is done or a decision is needed.

It asks for approval before sensitive actions such as sending messages or making payments. Memory, skills and connectors from the Claude app carry over, and the agent runs on Opus 5.5.

Access is through a waitlist for Claude Pro and Max subscribers in the US. Claude Duet is a standalone app on iOS and Android and is also available on the web at claude.ai. The Verge frames it as Anthropic's answer to Meta's Muse and OpenAI's Dots.

Other Developments

Models

  • AI startup Recursive on October 21 released Flint, a coding model that runs on a laptop. It is a mixture-of-experts model that uses 2.5 billion of its 40 billion parameters at a time, and it is free to download from Hugging Face under the Apache 2.0 license. The company says its automated research system, the Eureka Machine, helped with nearly every step of development. Recursive launches Flint, a laptop coding model it says was largely built by AI (TechCrunch)

Security

Research

Products

  • Walmart on October 21 announced Agent Gateway, which lets approved AI agents search its inventory and buy on a customer's behalf. It is offered as an MCP (Model Context Protocol) server, and from November, Agent Profiles will let customers set approval rules and spending limits for each agent. While Amazon blocks AI agents, Walmart rolls out the welcome mat (TechCrunch)
  • Google Cloud on October 20 released a preview of Gemini for government services, its AI agent tools adapted for US government agencies. It was developed with partners including the State of Missouri and the US Department of Health and Human Services (HHS), and Google says agency records and resident data stay within the organization's environment and are not used to train its foundation models without permission. Gemini for government services (ITmedia AI+, Japanese)
  • Japan ranks second in the world in weekly active users of dots, OpenAI's always-on agent feature, Tadao Nagasaki, president of OpenAI Japan, said on October 20. OpenAI's always-on agent dots: Japan ranks second in users (ITmedia AI+, Japanese)

Policy

  • Anthropic has been showing lawmakers a draft federal bill that would let a model's release be halted in certain cases, according to Politico. It covers a foreseeable, imminent risk of more than 50 deaths or over $1 billion in property damage from a biological weapon, a model evading its developer's controls, or a cyberattack. Independent evaluators registered with the Commerce Department would notify it within 72 hours, and the department would then ask a judge in Washington, D.C. to halt the release. Anthropic pitches AI safety bill that may block a model if 50+ people could be killed (TechCrunch)

Business

Source: Selected by the editors from the AI news inbox (collected October 22, 2026: 66 items, 21 primary and 45 secondary).