This week’s AI news had one big launch and two serious security scares, plus a batch of smaller updates worth knowing about.
Claude Duet Arrives
Anthropic launched Duet, its answer to ChatGPT’s Dot and Meta’s Muse. It’s a proactive assistant that messages you first, rather than waiting to be asked. In an early demo, it greeted a user with a morning summary covering health permits, hiring decisions and a lease renewal, pulling live data from point-of-sale systems, a CRM, payroll and a bank account, then laid it all out on a clean dashboard. It connects to Gmail, Slack, QuickBooks, Stripe, HubSpot, Shopify and more. Access is currently limited to a waitlist for Pro and Max subscribers.
A 20-Year-Old Bug, Found By AI
A serious vulnerability in PHP, the language behind roughly 70% of websites including Wikipedia and WordPress, was identified this week by OpenAI’s GPT-5.6 Soul before attackers found it. The bug itself has existed for twenty years, but exploiting it needed a chain of steps too complex for most human researchers to pull off. AI changed that. Cloudflare’s CEO said exploit attempts jumped from thousands to millions within hours of the public announcement. One security firm called it among the most severe vulnerabilities in software history.
The Railway Breach
Separately, the infrastructure platform Railway was attacked, and some encrypted environment variables, which often store API keys, may have been accessed and decrypted. Any company hosting an app on Railway that uses OpenAI or Anthropic’s tools had to scramble to rotate their API keys this week, because a leaked key lets someone else run up charges on your account. It’s a reminder that as AI gets better at both offence and defence in cybersecurity, the stakes on both sides keep rising.
Smaller Updates Worth Knowing
Ideogram released a vector image model, so you can now generate clean, editable SVGs from a prompt rather than flat images. Eleven Labs introduced Chimera, which syncs a photo and an audio clip so a still image appears to speak, though the lip sync is better than its handling of which image it actually uses. OpenAI kept shipping small daily updates to Codex, including longer cache times that should reduce token usage, plus a new locked-chat feature that hides sensitive conversations behind a PIN.
Agents Are Getting Blocked
A genuinely interesting trend: sites including Yelp, Delta, JP Morgan Chase, Amtrak and Amazon are starting to block AI shopping agents from acting on a user’s behalf. Shopify has gone the other way and welcomed agents fully. The logic is simple. If your AI agent does the shopping for you, the website you buy from becomes interchangeable, and that’s a threat to any retailer that relies on brand loyalty rather than price and speed.
If you want to use Claude with a properly structured, well-tested setup rather than leaving things to chance, Claude LaunchPad is the free starting point for getting that foundation right.
