The day's tech, sifted: Oct 22, 2026

Thu, Oct 22

What matters today: Anthropic previewed Claude Duet, an agent app that works in the background and messages you only when something needs attention. A New Mexico court ordered Meta to pay a $25B penalty in the Cambridge Analytica case, the same day Meta announced a new class of nonvoting shares to fund AI. Yesterday's PHP story got worse: AWS says exploitation began four days before disclosure, and GitLab patched its own critical flaw.

AI / LLMs

  • Anthropic previews Claude Duet: a proactive agent app for iOS, Android and the web that sends a morning brief, watches connected apps (Gmail, Slack, QuickBooks and others) and runs tasks on its own virtual machine, so your devices need not stay on. It asks approval before sending messages, paying or deleting, and blocks some actions such as moving money outright; access is a waitlist for US Pro and Max subscribers. Lenny's first take calls it polished but easy to forget to use, which is the test for any agent that waits for you to come back.
  • DeepSeek raises about $15B: Bloomberg's sources say the round of roughly 100 billion yuan is one of China's largest ever, with CATL and Tencent among the biggest contributors. Yesterday's US federal ban and open-source release now sit beside serious domestic capital.
  • Walmart opens an Agent Gateway: an MCP server (a standard plug that lets AI agents call a service) lets users' approved agents shop walmart.com, with dedicated Agent Profiles carrying their own "terms". TechCrunch contrasts it with Amazon blocking agents, so retailers are splitting on whether bots count as customers.
  • Thinking Machines shrinks a 276B model onto one GPU: Inkling-Small uses 12B active parameters per token and, per the report, matches the lab's 975B flagship across reasoning, coding and multimodal tasks. If it holds, frontier-class quality fits on hardware a small team can own.
  • Microsoft's agents prove a 31-year-old conjecture: human-directed agents proved a geometry conjecture underlying randomized sampling algorithms. Humans still pointed the work, so this is agents as research labor, not autonomous discovery.

Devtools & Infra

  • GitLab patches an unauthenticated code-execution flaw: the fix in 19.5.1 covers a critical bug that lets an attacker run code on a self-managed server without logging in, and it affects every release since 7.0 in 2014. After a week of PHP fires, self-hosted instances should be patched today, before anyone reverse-engineers the fix.
  • Microsoft and GitHub release a proof kit for AI Rust code: the Proof-Driven Development Kit (research preview) pairs agents with the Verus verifier so generated Rust must be formally checked against a spec. It answers "who verifies the builder" with a machine, not a reviewer.

Security & Privacy

  • PHP2Shell: exploitation began before disclosure: updating yesterday's patch story, AWS analysts say at least one actor started exploiting the bugs on Oct 17, four days before public disclosure, and that they are now broadly exploited; AWS has published a bulletin for its PHP runtimes. Patching on disclosure day was already late for some servers, so check logs from before the patch.
  • Railway discloses a possible environment-variable breach: the cloud host says an unauthorized party may have accessed customers' encrypted environment variables and, for some, obtained the decrypted contents. Environment variables hold API keys and database passwords, so affected customers should rotate them.
  • Smart TVs keep sending tracking data after opt-out: Northeastern researchers found Samsung, Vizio and Roku TVs still contacted content-recognition servers after users opted out (that software captures screenshots or audio to measure viewing and target ads). The paper points to potential privacy violations, so the opt-out switch is not evidence the data stopped.

Startups & Industry

  • Meta ordered to pay a $25B penalty in New Mexico: the state's justice department won the penalty for deceiving users about privacy on Facebook in the Cambridge Analytica case, CNBC reports. At $25B this dwarfs a typical privacy fine, though the outcome of any appeal is not yet known.
  • Meta creates nonvoting shares to fund AI: the new class will fund AI work, acquisitions and compensation, with trading from 2027, and 2026 capex guidance rose to $135B to $145B from $130B to $145B. A filing says Zuckerberg committed to living in Meta's HQ jurisdiction in return, after weighing leaving California over a proposed wealth tax. Meta also said Muse passed 10M users, with 25%+ buying through the app. Meta is raising money without diluting the founder's control.
  • Tesla: profit down 43%, unsupervised driving slips: Q3 revenue was flat at $28B, net profit fell to $787M, operating margin dropped to 2.6% and capex rose 110% to $4.7B. Electrek reports unsupervised FSD now lands in Q2 2027 and only inside Robotaxi zones, while Tesla says it will start selling Cybercabs by end of year. The autonomy timeline is again the swing factor for a shrinking-margin car business.
  • SpaceX-Tesla merger push, and a Starlink report: updating yesterday's committees, Bloomberg's sources say advisers want a merger announced by H1 2027 so it can close while Trump remains in power. Separately, the WSJ reports Musk ordered the Starlink slowdown that hit Ukrainian forces, which Trump denies ordering.
  • Flapping Airplanes raises $1B at $6B: the year-old AI lab is the day's latest mega-round, one year after founding.

Research

Elsewhere

  • Apple must open the iPhone to rival app stores in Australia: following the Epic ruling, 9to5Mac reports Apple must allow alternative app stores there, and the judgment is public. Another market opens after the EU, which adds pressure on the App Store's global model.
  • EA shuts BioWare: the studio behind Mass Effect and Dragon Age is closing and early work on the next Mass Effect ends, as Bloomberg reports about 400 job cuts across EA.
  • Xbox sells cloud playtime by the hour: 10 hours for $4, 50 for $12 to stream games you already own, in an Insider rollout, which makes streaming a second charge on a purchased game.

Hacker News

The front page leaned on stories covered above: Claude Duet led on comments (300, discussion), with Meta's $25B penalty, Railway's disclosure (212 comments), GitLab's patch and a post arguing the PHP bug has no easy exploit close behind. A mitmproxy commit adding an --emudhra option drew 342 points, the practical follow-up to last week's certificate revocations.

Elsewhere: Google's Rust style guide drew 250 points. Google staff resigned over the company's military AI contracts, the Australian judgment in Epic v Apple was posted, and a forum thread claims Plex laid off its whole player team, unconfirmed in what we read. For relief, a possum thought extinct for 6,000 years turned up in West Papua.

Threads

  • The PHP fallout widens: AWS's Oct 17 date, GitLab's critical patch and Railway's disclosure make this a week of patch-and-rotate, where defenders are behind from the start.
  • Agents that act while you are away: Claude Duet, Walmart's Agent Gateway and Microsoft's proof kit each decide who is allowed to act for you and who checks the work, and the memory-injection and approval-monitor papers describe how those checks fail.
  • Meta's money day: the $25B New Mexico penalty, the nonvoting share class and the higher capex guidance land together, pairing a privacy liability with a fresh AI funding tool.
  • Elon's empire, again: Tesla's slipping autonomy dates, the merger timing push and the Starlink report all turn on how much one person's decisions steer his companies.
  • Platforms losing exclusive control: Apple in Australia and Walmart choosing to welcome agents are two gatekeepers being forced or choosing to open the door.