Skip to content
Daily BriefNewsDaily Brief

7 AI stories from October 22, 2026: AI agents find a 22-year-old PHP flaw, Walmart opens its catalog to shopping agents, and 5 more updates from OpenAI, GitHub, n8n, AWS, and Recursive

· by Pondero Newsdesk · 7 stories

AI news daily brief: 2026-10-22

Seven stories cleared today's bar: one security incident, one model release, and five product launches spanning AI shopping agents, supply-chain defenses, cloud model distribution, and workflow automation.

AI agents helped find a 22-year-old PHP flaw affecting most of the internet

Two critical PHP vulnerabilities sat undetected in every version of the language since PHP 5 shipped in 2004, until AI agents from OpenAI and Google-owned Wiz surfaced them this month. A security firm called Calif found one flaw using OpenAI's GPT-5.6 Sol model under OpenAI's "Patch the Planet" initiative, per OpenAI's disclosure post. Wiz found and reported both using its own Wiz Atlas agent paired with Gemini 4 Argon and GPT-5.6 Sol. PHP runs roughly 70% of the world's websites, more than 33 million sites including WordPress installs, per TechCrunch's report. The PHP Foundation shipped patches and recommends upgrading to PHP 8.5.12; PHP 8.1 and earlier no longer get security support, so some operators face a forced version jump rather than a quick patch. The NSA issued a rare warning telling site operators to take affected systems offline right away if they cannot patch.

Full story: OpenAI and Google's Wiz used AI agents to find a 22-year-old PHP flaw hitting millions of sites

Recursive's Flint coding model was mostly built by its own AI research system

Recursive released Flint on October 21, a free coding model built to run offline on a laptop. The company says its automated "Eureka Machine" research system did most of the work building it, in under four months. Flint is a mixture-of-experts model with 40 billion total parameters and roughly 2.5 billion active per token, and it scores 74.2% on SWE-Bench Verified, beating every other sub-50-billion-parameter model on that benchmark, per the RecursiveSI/flint model card. TechCrunch measured about 131 tokens per second on a MacBook Pro M4 Pro, roughly double what Google's Gemma 4 manages on the same hardware, per TechCrunch's report. It ships free under Apache 2.0 on Hugging Face: no subscription, no per-token fee. The benchmark numbers come from Recursive's own test harness; nobody outside the company has reproduced them yet.

Full story: Recursive Flint: The Free Local Coding Model, Explained

Walmart opens an MCP shopping gateway to AI agents while Amazon keeps them out

Walmart launched Agent Gateway this week, an MCP server that lets approved AI agents search its inventory and complete purchases without touching a shopper's personal data or purchase history, per TechCrunch. CEO John Furner said at the Masters of Scale Summit that Walmart is preparing for "a world where AI agents become mainstream," according to the report. A companion feature called Agent Profiles rolls out next month, letting a shopper authorize each agent separately, require approval per transaction or set a spending limit, and revoke access anytime. That is the opposite of Amazon's posture: Amazon currently blocks AI shopping agents, including Meta's, from buying on its platform. Agent support covers Walmart and Sam's Club and needs no Walmart+ membership.

Full story: Walmart launches Agent Gateway, an MCP server for AI shopping agents

GitHub's new package firewall screens installs that agents and CI runners trigger

GitHub shipped package firewall into public preview on October 20, a proxy that sits in front of the npm registry and screens every install before it reaches a dependency tree, per the GitHub changelog. It blocks packages with an active malware advisory, flags a version that newly adds a preinstall or postinstall script, and can hold back anything newer than a configurable age window, one day by default. The target is the installs nobody watches: an agent pulling in a dependency to finish a task, or a CI runner that runs npm install unattended on every push. It is free during the preview, scoped to GitHub Enterprise Cloud, and npm only, so agents pulling from PyPI, Maven, Cargo, or container registries get no coverage from this yet.

Full story: GitHub Package Firewall: What It Blocks, What It Misses, and How to Turn It On

OpenAI's GPT-6 models enter private preview on Google Cloud's Model Garden

Google Cloud said on October 21 that it is now the only major cloud selling access to all three leading closed-source model families on one platform, after striking a deal to list OpenAI's newest GPT-6 models inside its Model Garden. Three models enter private preview for select enterprise customers: GPT-6 Astra for coding and research, GPT-6.1 Sol for near-Astra intelligence at lower cost, and GPT-6 Luna for faster everyday work, per Google Cloud's announcement. Customers buy through Google Cloud Marketplace, usage lands on one Google Cloud invoice, and spend counts toward existing Flexible Savings Plan commitments. Developers can also point local Codex CLI and Desktop workflows at Google's Gemini platform for inference starting now; OpenAI says Antigravity and Gemini Agent integrations are coming soon, per OpenAI's own post.

Full story: OpenAI brings three GPT-6 models to Google Cloud's Model Garden

n8n 2.45 closes a budget blind spot in nested AI agent workflows

n8n's 2.45 release, tagged October 20, extends budget alerts and automatic spend stops to sub-agent runs instead of only the top-level agent, closing a gap where a workflow's nested agents could run up API costs the cap never watched, per the release notes. The AI execution log now shows which model actually generated a response when a node is set to pick one dynamically, rather than only the configured default. The Text Classifier node gained an opt-in confidence score, and n8n added automated migration notices when a removed node needs replacing. Node and credential type policies are now on by default, and a blocked tool call shows the specific policy reason instead of a generic refusal, tightening governance defaults for teams running agents against systems they would rather keep locked down.

Full story: n8n 2.45 extends agent budget stops to sub-agents and logs which model answered

AWS adds a Smartsheet MCP server for AI agents managing project data

AWS published a guide for a new Smartsheet MCP server, a standardized integration spanning more than 40 tools for exploring, creating, and managing sheets, rows, columns, and automations, per AWS's blog post. The server connects to Amazon Quick and to Kiro, AWS's agentic developer IDE, letting an agent read and update project-management data through the same protocol it already uses to reach other tools instead of a one-off Smartsheet integration. AWS's post does not list pricing or a general-availability date beyond the integration itself, so teams evaluating it today are working from the setup guide alone.

Sources