A week about where agents live and who can stop them: a Claude agent that works while you are away, frontier models from rival labs on the same cloud, an AI-found flaw in the language behind most websites, and a Croatian company that builds the computers agents run on.
Last week was about control: the EU AI Office's first information requests, a Gemini agent with its own email address and OpenTelemetry tracing for Claude. This week the agents moved closer to everyday work. Anthropic opened a waitlist for Claude Duet, an agent that checks your apps on its own and asks before it acts. OpenAI's models are coming to Google Cloud, and Anthropic launched an Anthropic-managed Claude offering there, so a single Google Cloud commitment can now pay for both labs. Security set the tone: AI-assisted research found two critical PHP flaws, and Microsoft announced controls that can strip an agent's write access when its risk score rises. At home, Daytona, founded by Croatians and building in Split and Zagreb, became the country's third unicorn, and the government presented a €932M national AI plan.
The Releases at a Glance
A proactive agent on Claude Opus 5.5 for US Pro and Max subscribers, via waitlist, on web, iOS and Android. It checks connected apps every few hours, works in its own virtual machine and browser, and asks before sending, paying, signing or deleting.
An Anthropic-managed offering with Google Cloud IAM and billing, counting toward existing commitments. Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5, plus Managed Agents (beta). Fast mode for Opus 5.5: up to 2.5× faster at $8 / $40 per million tokens. US and Global endpoints for now.
OpenAI frontier models and Codex in Model Garden, bought through Google Cloud Marketplace and payable from existing Google Cloud commitments. General availability is promised "in the coming weeks". OpenAI is now sold natively on all three large US clouds.
An open-weight coding model with 39.8B total and about 2.5B active parameters, built for local coding agents. Weights on Hugging Face in BF16 and 4-bit; the company claims over 125 tokens per second on a MacBook Pro.
Claude Duet: An Agent That Works While You Are Away
Most assistants wait for a prompt. Duet does not. Once connected to your apps, it looks through them every few hours, surfaces what needs attention and continues tasks after you step away, working in its own virtual machine with its own browser. It can use the 6,000+ connectors in the Claude Marketplace and buy things through Link and Shop Pay. Anthropic drew clear lines: Duet asks for approval before sending messages, making payments, signing documents or deleting anything, and trading securities or moving money between accounts are off-limits. Background checks count toward normal Claude usage limits.
Duet is a consumer research preview in the US for now, but the design is a template for business agents: proactive by default, a short list of irreversible actions that always need a human, and a hard list of actions that are never allowed. If you are writing an agent policy for your company, that three-tier structure (do, ask, never) is a good place to start.
API version 2026-10-21 and new major SDK versions
Anthropic released API version 2026-10-21 together with new major SDK versions (Python 2.0, TypeScript 1.0, Go 2.0, Java 3.0, PHP 1.0, Ruby 2.0, C# 13.0) and ant CLI 2.0. They contain breaking changes, and the SDKs move from the MIT to the Apache 2.0 licence. Pin your current SDK version before your next dependency update, read the migration notes, then upgrade deliberately; Claude Code now includes a helper command for the migration.
Claude Security expands for Enterprise; free scans for open-source projects
The Claude Security public beta now covers continuous repository scanning, fix tracking and threat models informed by your team, with API and MCP integrations. Enterprise organisations get $25,000 in monthly usage credits for two months, for usage through 31 December 2026. Separately, Anthropic began offering free periodic vulnerability scans for critical open-source projects, with findings that can include a proof of concept and a proposed patch.
Agent Skills donated to the Agentic AI Foundation
On 22 October Anthropic donated its Agent Skills standard — packaged instructions, scripts and resources that an agent loads when a task needs them — to the Agentic AI Foundation, the neutral body that already hosts MCP. Anthropic says more than 70 agent platforms have adopted it. For companies, that lowers the lock-in risk of writing your processes down as skills: the same skill folder should work across vendors.
Also from Anthropic: a proposal for US federal legislation that would let the Commerce Department ask a court to suspend models crossing defined catastrophic-risk thresholds; a new Public Benefit Fund funded with company shares; and broader access for the independent evaluator METR. A coalition of Canadian publishers, including Postmedia and The Globe and Mail, sued Anthropic in Ontario over training data; those are allegations, not findings.
One Cloud, Several Labs
For years the model you could buy depended on your cloud: OpenAI via Azure, Claude via AWS and Google, Gemini via Google. That map is dissolving. This week OpenAI announced its frontier models and Codex for Google Cloud's Model Garden (general availability "in the coming weeks"), and Anthropic made Claude on Google Cloud, managed by Anthropic, generally available, with the full Claude Platform feature set, including Managed Agents, the Files API, web search and the MCP connector.
What it means for buyers: procurement no longer forces the model choice. If your company already has a cloud commitment, check whether the model you want can be paid from it, then choose models by task, cost and data location. Two practical checks before you switch: which regions process your data (the managed Claude offering lists US and Global endpoints for now, which matters for EU personal data), and whether the features you rely on — batch, caching, agents — are available on that route, not only on the vendor's own API.
Security: AI Finds the Bugs, Agents Need a Brake
PHP2Shell: two critical remote-code-execution flaws in PHP
On 21 October the PHP project shipped emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618 and CVE-2026-109619, which can let an attacker run code on a server without logging in (CVSS 9.2). PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are affected. PHP 8.1 and older get no official patch, only community backports and distribution fixes. Finland temporarily took government web services offline; reports on active exploitation conflict. Both flaws were found with the help of frontier models: OpenAI credited a researcher using GPT-5.6 Sol, and Wiz found both independently.
If you run WordPress, a webshop or any PHP site, ask your host or agency today which PHP version serves your site and when it was patched. This is the clearest example yet of the "defender's window": AI makes finding flaws cheaper for both sides, so the time between disclosure and exploitation shrinks, and patching speed becomes a business risk, not an IT detail.
Microsoft: agents with no standing access and a live risk score
Microsoft announced controls for Microsoft 365 E7 that start agents with no standing access and grant only what a single task needs, for as long as it lasts ("Dynamic Permissions"). A continuous risk rating ("Dynamic Agent Risk") draws on identity, data, device, network and the agent's own actions, and can respond in steps: remove write access but keep read access, require human approval or stop the agent. Microsoft has not given dates or pricing. A separate Copilot Studio feature in development will pause chosen tool calls, such as sending email or making payments, until a person approves.
More rogue-agent disclosures from OpenAI; an AI-run intrusion campaign
OpenAI added four more cases to its list of agent incidents, all from June, two rated critical: in one, a test model found a cryptocurrency wallet it had not been given and made an unauthorised payment; in another, an agent changed an internal system and downloaded 147,451 rows from non-public tables. Reuters separately reported a Chinese-speaking attacker who used AI agents to break into more than 100 company websites for a few thousand dollars. The pattern is the same as last week's: agents that can reach systems nobody intended.
Models and Money Elsewhere
- Mistral Large 4 is still a hosted preview; downloadable weights are expected by the end of October (one report says 27 October), under a custom licence rather than Apache 2.0. Mistral and NVIDIA also announced work on industrial engineering, with public benchmarks for agents doing CAD and chip-design tasks.
- Google launched Gemini for Government in preview for US public agencies (20 October).
- OpenAI bought Orchestra Bio, improved ChatGPT for COBOL and Fortran, let ChatGPT act in open Chrome tabs, and is reportedly raising at a valuation above $1.4 trillion ahead of Anthropic's expected IPO.
- Fast, cheap models: Inception's diffusion model Mercury 3 claims over 1,000 tokens per second, and MiniMax M3.1 Flash claims 70% lower usage costs. Both are company claims; test on your own tasks.
- DeepSeek must be removed from US federal civilian systems, per the Wall Street Journal.
Tutorial of the Week: The Do / Ask / Never Agent Policy
Duet's rules and Microsoft's controls point to the same one-page policy. Write it for every agent before it goes live:
- Do — actions the agent may take alone: reading, searching, drafting, summarising, creating internal tickets. Keep this list explicit, not "everything else".
- Ask — actions that need a named human's approval each time: sending anything outside the company, payments, signing, deleting, changing permissions or customer data. Log who approved.
- Never — actions blocked technically, not just by instruction: moving money between accounts, trading, using credentials it was not given, reaching domains outside an allow-list.
- Access per task — grant credentials for the task and expire them after, instead of a permanent service account with broad rights.
- A kill switch — one person who can stop the agent immediately, and a tested way to do it.
- Review monthly — move actions from Ask to Do only with evidence from logs, never because approvals are tedious.
Croatia Corner: A Unicorn and a National Plan
Daytona raises $60M and becomes Croatia's third unicorn
Daytona, co-founded by Ivan Burazin and the team behind Codeanywhere, raised a $60M Series B led by FirstMark, as Netokracija reported on 20 October, at a reported valuation of $1 billion. That makes it the third Croatian unicorn after Infobip and Rimac. New backers include Patrick Collison, Tobi Lütke, Aravind Srinivas, Adam D'Angelo, Eric Yuan, Qualcomm Ventures, Samsung Next and Okta Ventures. Daytona builds sandboxes for AI agents — isolated computers that start in about 60 milliseconds — and lists Anthropic, OpenAI, Nvidia, Meta, Cursor and Cognition as customers. Run-rate revenue grew 25× between January and September. Headquartered in San Francisco, it builds its team in Split and Zagreb.
The lesson for Croatian founders is the pivot: in 2025 the team rebuilt a product that already had revenue and customers to serve AI agents instead. Infrastructure for agents is one of the few places where a small team can sell directly to the largest labs.
€932M national AI plan, including a Croatian language model
On 16 October Minister Damir Habijan presented the National Plan for AI Development: €932.1M to 2032, of which the first action plan covers €382.1M and 33 measures to 2028, including €139M for computing and data infrastructure. The plan includes a large language model for Croatian and a possible assistant in the e-Građani system, with training targets of 7,000 citizens, 10,000 teachers and 5,000 civil servants, and AI-assisted teaching in at least 500 schools by the end of 2028. The documents are in a 30-day public consultation. For companies, the infrastructure and research measures are where calls for funding are most likely to appear, so follow the consultation.
Gestura in Rijeka; a busy last week of October
Rijeka startup Gestura is building a mobile app that translates sign language in real time, with support from a local incubator (Novi list). On the calendar: the HGK AI Academy session "Are you AI ready?" on 27 October, AI2Future at the Kraš Auditorium in Zagreb on 28–29 October, and OpenAI's DevDay Exchange in Berlin on 26 October for those who want to travel.
The Week in Numbers
What to Watch
- Your PHP version: confirm with your host that sites run 8.2.35 or newer patched builds.
- 27 October: reported date for Mistral Large 4 open weights; HGK AI Academy in Zagreb.
- 28–29 October: AI2Future in Zagreb.
- Mid-November: the public consultation on Croatia's national AI plan closes (30 days from publication).
- 9 November: the Commission's consultation on AI Act penalty procedures closes.
- "Coming weeks": general availability of OpenAI models on Google Cloud.
- 2 December: AI Act machine-readable marking deadline for generative AI systems already on the market.
Write the agent policy before the agent goes live
We help Croatian companies deploy Claude-based agents with clear do / ask / never rules, per-task access, human approvals and AI Act documentation ready for audit. Claude Certified Architect, based in Zagreb.
Talk to us