Hey folks,
Busy week at Anthropic. They launched Claude Duet to complete with ChatGPT Dots, Muse, Grok Bot and Hermes personal always-on agents as well as launching Claude Security for continuous code scanning instead of someone having to remember to manually run /security-review.
And the internet had a rough few days. Security people are calling it Black October: a pile-up of serious flaws and breaches, many of them found with AI.
Let's dive in..
Claude Duet: one thread, many hands
Duet is an agent that keeps working when you close the app. It checks your connected apps every few hours, sends a morning brief, and asks before it sends, pays, signs or deletes anything.
Alex Fynn raves about is how you work with it. You get one chat. Every time you give it something to do, Duet spins it out into its own task thread on a list. You can watch each one run, but you don't have to manage them.
He also had it built code changes he could review, and it came up with work on its own, a super proactive personal agent.
"This allows you to just keep brain dumping ideas and tasks into the one thread, and not have to worry about the agent getting confused."
An interesting feature is the new way of interacting with tasks, and the action method being called Tinder for Tasks, where you swipe right to action a task, swipe left to discard it. This is a fun way to clear your backlog of work.
Duet is built for delegating, not chatting. If you treat it like an assistant you hand a list to and check on later, it's the best-designed agent out there right now. If you expect quick back-and-forth like ChatGPT, it'll feel slow.
If you're in the US on Pro or Max, join the waitlist. Everyone else has 2 options:
No code: run one Cowork session as your "inbox" and schedule a morning task that reads your email and calendar. Less polished, same habit.
Open Sourced: a developer has already built Open Duet, a free, open-source take on the same idea. You get named AI coworkers with memory, schedules and an approval step before anything risky. It runs on your own Claude login, works from a browser or Telegram, and has close to 6,000 stars on GitHub. Fair warning: setup needs a terminal, it's unofficial, and it's still rough around the edges. Hand it to your most technical friend.
Black October: AI found the bugs
If your security team looked tired this week, this is why. Around 22 Oct, people in cyber started calling this month Black October. It's a pile-up of serious flaws and breaches all landing in the last few weeks.
Here's the short list worth knowing:
php2shell (21 Oct): 2 critical flaws in PHP, the language behind roughly 70% of websites, WordPress included. An attacker with no login could make your server run their commands. Rated 9.2 out of 10. Amazon spotted attack attempts 4 days before the fix shipped, and some governments pulled websites offline as a precaution. It caused major panic due to the amount of PHP on the web.
GitLab (last week): a flaw rated 10 out of 10 in self-hosted GitLab, the tool many companies keep their code in. Solution: Use GitHub.
Node.js (21 Oct): a flaw in Node.js, which runs the back end of a huge number of web apps, that could let an attacker run code via a booby-trapped compressed file. Reported by OpenAI's security researchers.If you’re a vibe coder, check your codebase.
LiteLLM (21 Oct): a poisoned update of a popular open-source AI tool. Install it and it quietly steals your passwords, cloud keys and AI account keys. It was live for about 2 hours before it was pulled.
eMudhra (17 to 20 Oct): a company that issues the certificates behind the padlock in your browser had keys so weak they could be guessed. Google, Apple, Microsoft and Mozilla all blocked its certificates.
The thread that ties it together: AI found a lot of this. Wiz says it found php2shell with help from Google and OpenAI models. OpenAI's researchers reported the Node.js flaw. Mozilla said AI agents it tested could recover eMudhra's weak keys on the first try.
Bugs that sat unnoticed for a decade are now being found in weeks. The bad guys have the same tools.
One fair pushback, from Forkast: most of these problems are months or years old. Black October is the week the flaws arrived, not the week the attacks started.
What to do this week (the vibe code version)
Check my code for the "Black October" security flaws from October 2026. Look up the latest patched versions of PHP, GitLab and Node.js, then check which ones my project uses and whether we're on a safe version. Explain what you find in plain English. If anything needs updating, show me the fix and wait for my OK before you change anything.Where Claude Security fits
Black October has 2 halves. Half of it is other people's software: PHP, GitLab, Node.js. That's a patch job. Claude Security covers the other half: the code your own team wrote.
Claude Security got 2 upgrades that matter in a month like this:
It scans continuously. Connect your GitHub or GitLab repositories once. It does a deep first scan, then re-checks code as changes land, instead of waiting for someone to press a button.
It tracks fixes. When your team fixes a problem, it marks it closed. If the problem creeps back in, it reopens itself.
It also builds a threat model of your code (a map of how an attacker could get in) and ranks each finding against it, so the scary ones come first.
If AI is finding bugs this fast, a once-a-quarter security check is out of date the day it's run.
Honest limit: it finds and tracks problems, it doesn't fix them for you. Your team still writes and approves every fix. It’s in public beta for Claude Enterprise only, switched on by an admin.
I hope you enjoyed the AI buzz today.
👉 This issue is brought to you by BOS, The Business Operating System by UseKase.
👍 Refer our newsletter to your friends and help us grow.
Cheers, Tim
