OpenAI Brings Its Models to Google Cloud as AI-Found PHP Flaws Force Urgent Patches and Anthropic Previews Claude Duet

OpenAI Models and Codex Are Coming to Google Cloud’s Model Garden

The biggest platform news of the day crossed a long-standing rivalry. OpenAI’s announcement that its models are coming to Google Cloud, dated Wednesday, October 21, says the two companies are partnering to bring OpenAI’s frontier models and Codex agentic workflows into Google Cloud’s Model Garden. Google Cloud customers will be able to buy the models through Model Garden, transacted through the Google Cloud Marketplace, and enterprises with Google Cloud spend commitments will be able to draw those commitments down on the purchases. OpenAI also says its models will soon be available in Google Antigravity and the Gemini Agent. The pitch is aimed squarely at regulated industries: the models are paired with Google Cloud’s built-in access controls and centralized data governance. General availability is planned in the coming weeks, and the post closes by noting that Microsoft remains OpenAI’s primary cloud partner.

“We are focused on giving customers a broad selection of models, including those from OpenAI, so they can choose the right model for any given job, helping to deliver optimal quality and lower costs.” — Thomas Kurian, Google Cloud

OpenAI president Greg Brockman framed the deal as putting OpenAI’s most capable models and Codex where customers are already building. For Google, hosting a direct competitor’s models in its own catalog, and inside its own agent products, is a clear statement that it would rather win the cloud bill than force customers to pick one model family.

OpenAI’s Patch the Planet Coordinates Fixes for Critical AI-Found PHP Flaws

The most urgent story for anyone running a website is a security one. OpenAI’s Patch the Planet post on coordinated disclosure of critical vulnerabilities says that over the past two months it led a coalition of maintainers, researchers and security providers to address critical flaws in PHP. According to OpenAI, Calif identified a critical flaw using GPT-5.6 Sol as part of the Patch the Planet initiative, and Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes and the release, while OpenAI, Wiz, Cloudflare and others contributed research, technical support and coordination, including outreach to the Office of the National Cyber Director, CISA and international partners. OpenAI calls it one of the most impactful security issues in recent memory and committed $1 billion in subsidized access to Daybreak through a Daybreak for Frontline Defenders program focused on organizations with limited security resources that protect essential services.

“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.” — OpenAI

The fixes themselves come from the PHP project. PHP’s October 21 security advisory and release notes say PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution: CVE-2026-109618, in which out-of-memory handling can leave internal request data only partially initialized, and CVE-2026-109619, in which request-owned state can survive after its memory is freed and be reused by a later request on the same worker. The project’s advance notice rated both at CVSS v4.0 9.2. PHP says every installation serving web requests is at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, with risk highest for mod_php, and that PHP 8.1 and older no longer receive updates from the project.

“There are no complete mitigations, updating is the only safe choice.” — The PHP development team

Canada’s Cyber Centre alert on the PHP vulnerabilities notes open-source reporting that a proof of concept exists, with no active exploitation identified at the time of its alert. OpenAI also published its php2shell-checker repository on GitHub, a Codex skill and Node script that reads a site’s X-Powered-By and Server headers or a local php -v; its README warns that an UNKNOWN result does not mean the target is patched.

Anthropic Opens a Research Preview of Claude Duet, a Proactive Agent App

Anthropic entered the personal-agent race with a separate app. Anthropic’s introduction of Claude Duet, dated October 21, describes a new app where Claude works as a proactive agent for professionals and small business owners: each morning it sends a short brief on the most important items across connected apps, it messages users through the day only when something needs attention, and it can take on tasks from scheduling meetings to building dashboards, financial forecasts and web apps. Duet is built around Claude Opus 5.5, carries over memory, skills and connected apps from a user’s Claude account, and runs on a virtual machine with its own browser so work continues when the phone is off. It is available by waitlist on iOS, Android and claude.ai, starting with US Pro and Max subscribers, and shares those plans’ usage limits. Before it sends a message, makes a payment, signs a document or deletes anything, it shows the action and waits for approval, and some actions, such as trading securities or moving money between accounts, are off-limits even with approval.

“An agent that reads email and sends messages for you is constantly deciding where information should go.” — Anthropic

To handle that risk, Anthropic says Duet ships with a new dedicated classifier and safety system prompt designed to reject requests to share the strictest tier of information, such as credit card numbers and government identification. The company also admits the preview might misread a thread or miscalibrate what is urgent. CNBC’s report on the Claude Duet preview frames it as a challenge to Meta’s Muse and OpenAI’s dots, and notes that Mark Zuckerberg told analysts on Wednesday that more than 10 million people in the U.S. and Canada have set up Muse personal agents.

Claude Security Now Scans Continuously and Tracks Fixes

Anthropic also upgraded its code-security product. Anthropic’s post on Claude Security’s continuous scanning, dated October 21, says that since Claude Security entered public beta in April, thousands of organizations have used it to find over a million vulnerabilities. The new version no longer waits for someone to start a scan: teams connect repositories through the Claude GitHub app, including GitHub Enterprise Server, or with access tokens from GitLab and other Git providers, and Claude runs a deep baseline scan, then scans changes regularly based on their risk and complexity. A project can hold multiple repositories so Claude can catch problems that live between services. Open findings are checked against changed code and marked fixed when the fix lands, wherever it was made, and they reopen automatically if the issue comes back. Each project also gets an editable threat model and knowledge base, plus a new API, webhooks, an MCP connector and role-based access controls. The update is in public beta for Claude Enterprise customers, with $25,000 in free usage credits a month for two months, for usage through December 31, 2026.

“Claude Security found many material issues that a traditional pen test conducted at the same time missed, several of which would have had significant impact if exploited in the wild.” — Jon Donovan, IonQ

NVIDIA Locks In Supply Chain Capacity With Six Manufacturing Partners

On the hardware side, NVIDIA used GTC Berlin to address its biggest constraint. NVIDIA’s newsroom release on supply chain capacity expansion, dated October 21, names Amkor, IBIDEN, King Yuan Electronics (KYEC), Samsung Electro-Mechanics, SPIL and Unimicron as partners expanding substrates, advanced packaging, testing and optical engines. NVIDIA says substrate agreements with IBIDEN, Samsung Electro-Mechanics and Unimicron will together drive a 2.5x capacity increase over three years, with NVIDIA giving IBIDEN a multibillion-dollar capacity reservation advance for its Ono plant in Japan. Amkor plans to raise interposer wafer capacity in South Korea by more than 300% by the end of 2028. A $1.1 billion reservation advance to KYEC will fund new U.S. testing facilities targeting high-volume production in April 2027, and NVIDIA expects its total testing capacity to double from 2026 to 2027. SPIL is targeting a 15x increase in optical-engine capacity for co-packaged optics by mid-2027.

“We are in the midst of the largest infrastructure buildout in human history. Demand is extraordinary. Capacity is the constraint.” — Jensen Huang, NVIDIA

Thousands of GPT-Rosalind Agents Surface a Perry Syndrome Lead in Brain-Cell Data

OpenAI also published a research result in biology. OpenAI’s write-up on using thousands of AI agents to find leads in biological data, dated October 21, says OpenAI, PerturbAI and Scripps Research ran thousands of agents powered by GPT-Rosalind over a whole-brain CRISPR atlas of millions of mouse brain cells in 32 minutes, an approach OpenAI calls distributed biological reasoning. Each agent investigated one gene disruption, analyzed the cellular response, searched the literature and proposed explanations, and the reports were merged into a reasoning atlas that OpenAI says researchers can begin exploring today. The team estimated comparable human analysis would take months to a year. In a controlled comparison, a single agent cited only 11 references at the largest workload while the distributed agents cited more than 700, and blinded human experts preferred the distributed reports 75% of the time. Among the leads: in DCTN1, the gene whose mutations cause Perry syndrome, disruption raised expression of cholesterol-making genes, prompting a testable hypothesis that cholesterol distribution inside neurons could contribute to neurodegeneration. The agents also flagged a cerebellum-specific difference between Tsc1 and Tsc2, which is relevant to tuberous sclerosis.

Physicist Christopher Stubbs Joins Anthropic’s Long-Term Benefit Trust

Anthropic’s governance story added a new trustee. Anthropic’s announcement that Christopher Stubbs has joined the Long-Term Benefit Trust, dated October 21, says the Harvard experimental physicist and former Dean of Science, who helped discover the accelerating expansion of the universe as part of the High-Z Supernova Search Team and is a member of the JASON advisory group, becomes the Trust’s first physicist, alongside Neil Buddy Shah, Richard Fontaine and Ben Bernanke. The Trust has authority to appoint a majority of Anthropic’s board. The same week, Anthropic published its first 2026 Public Benefit Report on progress toward its charter, which measures the company against five charter pillars and closes with commentary from the Trust itself. The trustees praise Anthropic’s candor and willingness to make costly decisions, but push for harder evidence next time, including independent confirmation that its most capable models resist misuse and remain under human control.

“Right now, it largely describes inputs; in subsequent reports, we will increasingly look for Anthropic to produce outcomes.” — Anthropic’s Long-Term Benefit Trust