Newsletter

Obizworks AI Brief #2

By Obizworks Editorial · 2026-10-30 · 5 min read
🛈 Governed AI, human-reviewed. Drafted by Obizworks' governed AI and reviewed by a human before publication.

Welcome to the second Obizworks AI Brief: one short email a week on what changed in AI, what it means for a small or mid-sized business, and a few things you can try. This issue covers 18 to 24 October.

The big picture

AI is now finding software flaws faster than people can patch them, and attackers are using agents too. At the same time, the new agents from the big labs are being built to ask permission before they act. The lesson for a small business is the same on both sides: keep your systems patched, and give every agent clear limits and an approval step.

What happened

1. AI finds two 20-year-old holes in PHP, the language behind most websites. On 21 October the US NSA warned of two critical flaws that have sat in every version of PHP since 2004. They were found by security teams using AI models, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. PHP runs roughly 70% of websites, including WordPress sites. Details leaked a day before the fix, and several government websites in Europe and Australia went offline while they patched. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Why it matters: if your website, booking page or customer portal runs on PHP, ask your host or developer this week which version you are on. The NSA's advice is to take a site offline if it cannot be patched.

2. Attackers are using agents as well. On 21 October Microsoft linked an attack through ConnectWise's cloud backup service to a China-aligned group it calls Storm-0940. The group used ARTEX, an AI agent built for penetration testing, and in some cases reached privileged cloud access in under three hours. Security firm Huntress counted more than 160 customer accounts breached. Why it matters: the tools your IT provider uses are now a target. Ask your provider how they protect remote-access and backup tools, and turn on multi-factor sign-in everywhere it is offered.

3. Anthropic launches Claude Duet, an agent that comes to you. On 21 October Anthropic opened a waitlist for Claude Duet, a "proactive" agent for US Pro and Max subscribers. It checks your connected apps every few hours, sends a morning brief, and does tasks in the background. It asks for your approval before it sends a message, makes a payment, signs a document or deletes a file. Why it matters: this is the shape of the next wave of assistants: working in the background, with a person approving anything that matters. Use that as your standard when you choose any agent.

4. Walmart gives AI shopping agents their own accounts and spending caps. On 21 October Walmart launched Agent Gateway, which lets approved AI agents search its inventory and buy for customers. Each agent gets its own profile with a spending limit and per-purchase approval. Why it matters: this is a good template for any business letting an agent spend money: a separate identity, a hard cap, and a person who approves. It is also a sign that customers will soon arrive through agents, not just through your website.

5. OpenAI makes a cheap "yes, no or score" model generally available. OpenAI's Decisions API, powered by GPT-6 Luna, reached general availability on 23 October. Instead of writing text, it returns a choice, a probability or a score, for example "is this invoice a duplicate?" or "how urgent is this ticket?". OpenAI says it is up to 10 times faster than its general-purpose route, and input costs $0.10 per million tokens with no charge for output. Why it matters: many routine business decisions, such as sorting, flagging and routing, do not need an expensive model that writes paragraphs. A scoring model is cheaper and easier to check.

6. Canva releases its own image model, Craft. Also on 23 October, Canva launched Craft, its first in-house image generator. Because it was trained on design templates, its pictures come out as editable, layered designs rather than flat images. It is available in Canva's Dream Lab and through its API. Why it matters: if your team already makes social posts and flyers in Canva, you can now generate a first draft and still edit every element. Keep a person checking brand and accuracy before anything is published.

Behind the headlines: what AI really costs

Reports on 23 October about Anthropic's planned stock-market listing put its revenue for the first half of 2026 at $16.3 billion, against a net loss of $80.7 billion, most of it accounting charges. Separately, Google's introductory price for Gemini 4 Argon is due to double on 1 December. Today's AI prices are not guaranteed to last. Build your budgets and contracts so you can switch models if prices rise.

Three things to try this week

1. Ask one question about your website. Send your host or developer this: "Which PHP version does our site run on, and is it patched to the October fix?" Keep the answer on file.

2. Give every agent its own identity and limit. If an AI tool can send, spend or delete, give it its own account, a spending cap and an approval step. Never let it use a staff member's login.

3. Check the price-change date in your AI plans. Look at the AI services you pay for and note any introductory price or renewal date. Put a reminder in your calendar a month before.

On the Obizworks blog

Sources