AI news, 22 Oct: an AI assistant that asks before paying, Walmart lets AI shoppers in, and a day of urgent patches
Anthropic opened a research preview of Claude Duet, an assistant that reaches out on its own but waits for approval before sending, paying, signing or deleting anything. Walmart lets AI agents shop on behalf of customers, with a dedicated gateway, agent profiles and spending limits. And on 21 October urgent patches arrived for PHP and Node.js, while a compromised version of the LiteLLM package stole credentials.
What happened
Claude Duet is an assistant that doesn't wait to be asked: every morning it sends a short briefing from connected apps, checks them every few hours during the day and speaks up when something needs attention. It runs on its own virtual computer in the cloud. Before it sends a message, makes a payment, signs a document or deletes anything, it shows what it intends to do and waits for approval, and some actions, such as trading securities or moving money between accounts, are not allowed even with approval. It starts with a waitlist for Pro and Max subscribers in the US.
Walmart announced that AI agents can shop on behalf of customers. The Walmart Agent Gateway starts in beta for businesses and developers. Agent profiles arrive within the next month: customers choose whether to approve every purchase or set a limit, for example 50, 100 or 200 dollars. By default the customer approves purchases, agents get no card details and see the same prices as people, returns apply even when an agent makes a mistake, and agents that break the rules will be blocked. TechCrunch contrasts this with Amazon, which has started blocking AI agents that shop for users.
On 21 October PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, closing two critical vulnerabilities. Under certain conditions an attacker can run their own code on the server without logging in. The same day Node.js released security updates 26.12.1, 24.22.1 and 22.23.4. A compromised version 1.107.0 of LiteLLM, a package used in AI applications, stole credentials; the advice is to go back to 1.106.2 and change keys and passwords.
What it means for you
- Decide what a human always approves. Make a list of actions a person always confirms in your business: sending quotes, payments, signatures and deleting data. When you bring in an AI assistant, the rules are already there.
- Make your online shop readable for agents. Prices, availability, delivery times and return terms should be on the page as plain text, not only in an image or a pop-up. If a machine can't read it, an agent will recommend a competitor.
- Ask your host about your PHP version. Updating plugins is not enough this time. Ask your hosting provider or web agency today which PHP version your site runs and whether it is patched, and have your developer check Node.js and LiteLLM.
2-Point Expert Read
Not sure how exposed your website is, or what AI assistants and search engines can see on it? Send me your link. Within 24 hours you get one finding about your website, one about your visibility on Google and in AI search, and a recommended next step. For small businesses and sole traders, no obligation.
Weekly AI Digest for Small Businesses
Once a week: AI news and what it means for your business.
Share this story
Sources
- Anthropic / Claude, 21 Oct 2026: Introducing Claude Duet (in English)
- Walmart, 21 Oct 2026: Making It Possible for Agents to Shop on Behalf of Customers (in English)
- TechCrunch, 21 Oct 2026: While Amazon blocks AI agents, Walmart rolls out the welcome mat (in English)
- The PHP Foundation, 21 Oct 2026: Today's PHP Security Release, and How We're Strengthening PHP Security (in English)
- Node.js, 21 Oct 2026: Wednesday, October 21, 2026 Security Releases (in English)
- LiteLLM, 21 Oct 2026: Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised (in English)