Thursday’s AI news has a theme: AI agents are getting real jobs, and everybody is scrambling to set the rules. AI helped find two critical holes in PHP, the language behind most websites, so if you run a site, you’ve got homework today. Anthropic opened a preview of Claude Duet, a proactive assistant pitched straight at small business owners. Walmart rolled out the welcome mat for shopping agents. And ChatGPT ads just landed in 26 more countries. Here’s what each one means for you.
1. AI found critical PHP flaws. If you have a website, check it today
The PHP project released emergency updates on Wednesday (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) to fix two critical bugs nicknamed “php2shell.” Under the right conditions, they let an attacker run code on a server without logging in. The U.S. cybersecurity agency CISA says the flaws affect all PHP installations serving web requests and urges organizations to patch immediately. CISA hadn’t seen them exploited when it published, but BleepingComputer reports Cloudflare’s CTO said the company was already seeing early attacks before the patches landed.
The AI angle: OpenAI says a security firm called Calif found one of the flaws using GPT-5.6 Sol as part of its Patch the Planet program, while Wiz independently found and reported both. OpenAI is sharing a free PHP version checker as a Codex skill and says it expects findings like this to “increase sharply in the coming months.”
Why it matters: PHP powers WordPress, Joomla, Drupal, and a huge share of small business websites. AI is now finding bugs faster than ever, which is great for defenders, but it also means the gap between “bug found” and “bug exploited” is shrinking.
Takeaway: if you have a WordPress site or any site on shared hosting, email or chat with your host today and ask one question: “Is my site on a patched PHP version: 8.5.12, 8.4.27, 8.3.36, or 8.2.35?” If you’re on PHP 8.1 or older, the PHP project no longer ships updates for it, so ask about an upgrade. Don’t wait for the next scheduled maintenance.
Sources: The PHP Foundation; CISA; BleepingComputer; OpenAI.
2. Anthropic’s Claude Duet wants to be your proactive assistant
Anthropic opened a research preview of Claude Duet, a new app where Claude comes to you instead of waiting for a prompt. It sends a short morning brief from your connected apps, checks in every few hours, and messages you when something needs attention. You can hand it bigger jobs too, like scheduling meetings, building dashboards, or putting together a sales forecast, and it keeps working on its own cloud computer after you close the app.
Anthropic says it built Duet “for professionals and small business owners,” and its product page mentions jobs like finding unpaid invoices and drafting reminders. Before it sends a message, makes a payment, signs a document, or deletes anything, it shows you exactly what it’s about to do and waits for your OK. Some things are off-limits even with approval, like trading securities or moving money between accounts. It runs on Claude Opus 5.5, it’s waitlist-only for U.S. Pro and Max subscribers, and its background checks count against your plan’s usage limits. Anthropic’s help page says Microsoft 365 isn’t supported yet and Team and Enterprise plans aren’t included.
Why it matters: the big AI labs are racing to build assistants that act without being asked. CNBC frames Duet as Anthropic’s answer to rivals like Meta’s Muse.
Takeaway: if you’re a solo owner drowning in email, join the waitlist. When you get in, start with the morning brief and invoice follow-ups only, and read every draft before you approve it. Anthropic itself says it can still misread a thread or misjudge what’s urgent.
Sources: Anthropic; Claude Help Center; CNBC.
3. Walmart lets AI agents shop for you, with spending limits
While Amazon has been blocking AI agents from buying on its site, Walmart is going the other way. TechCrunch reports Walmart launched Agent Gateway, a connection point that lets approved AI agents search its inventory and buy things for you. Next month it rolls out Agent Profiles, which give each agent its own profile on your Walmart account so you can see its purchases separately and either approve each order or set a spending limit. Walmart compares it to adding an authorized user to your credit card.
Walmart also published rules for agents: they can’t see your payment information, can only use the info they need for the task, and get blocked if they break the rules. And Walmart’s regular return process applies even when an agent buys something you didn’t want. It works with any Walmart account, no Walmart+ needed.
Why it matters: spending caps, separate purchase history, and a return safety net are exactly the guardrails people need before trusting a bot with their card.
Takeaway: if you try agent shopping, set a low spending limit and keep approval on for every order at first. If you sell online, notice the split: some big retailers are locking agents out and others are inviting them in. It’s worth asking your store platform what its plan is.
Source: TechCrunch.
4. ChatGPT ads expand to 26 more countries
OpenAI says ChatGPT Ads are now available in 89 countries after adding 26 more, including 14 Latin American countries plus markets like Nigeria, South Africa, Ukraine, and Pakistan. It says more than 100,000 advertisers have run campaigns since ads launched just over eight months ago. Ads only show on the Free and Go plans. Plus, Pro, and Enterprise stay ad-free. OpenAI says conversations stay private from advertisers, it doesn’t sell customer data, and ads don’t influence ChatGPT’s answers. Advertisers can sign up through partners or self-serve in Ads Manager.
Why it matters: people now ask ChatGPT what to buy, the way they used to ask Google. Showing up in that moment is becoming an ad channel like any other.
Takeaway: if you’re a local business, try a small test budget only if you can track results. And if you use free ChatGPT for buying research, remember that labeled ads can now sit next to the answers.
Source: OpenAI.
The wrap-up
Today’s lesson: AI agents are doing real work, from finding security bugs to buying your groceries, and the safety rails are being built in real time. Patch your website, keep a human approval step on anything that sends or spends, set spending limits, and know when you’re looking at an ad.
Share this article
Leave a Reply