AI Tools Weekly — Issue #3

AI Tools Weekly — Issue #3 | Oct 21 – Oct 26, 2026

> This issue's focus: what major AI labs and policymakers shipped this week. Every item was checked against official pages (lab blogs, Federal Register / GovInfo, Microsoft Security, AWS Open Source, Hugging Face model cards), verified on 2026-10-26 (Beijing time). Dates are those shown on the official pages. Our commentary is based on official materials, not hands-on testing by StackLoom. Benchmark results are vendor-reported unless stated otherwise. Full source list: AI Lab Tracker.

1. Claude Duet (Anthropic)

- Official link: https://claude.com/resources/articles/claude-duet - Release date: 2026-10-21 (Help Center release notes; product article has no dated byline in our fetch) - Key features: Research preview of a standalone proactive-agent app (iOS, Android, and claude.ai) built around Claude Opus 5.5. Morning briefs across connected apps; cloud VM with its own browser so work continues when you step away; approval required before sending messages, making payments, signing documents, or deleting anything. Some actions stay off-limits even with approval (e.g. trading securities or moving money between accounts). Included in US Pro and Max for the preview (waitlist); same usage limits as the rest of Claude; not yet on Team or Enterprise. - Our take: Anthropic is packaging Opus 5.5 as a always-on work partner rather than another chat surface. Worth watching for how approval gates and off-limits actions hold up once more connectors are in use. We have not tested the preview. - Pricing: Included with US Pro / Max during the research preview (waitlist); shares plan usage limits. - Sources: official link; https://support.claude.com/en/articles/12138966-release-notes ; https://support.claude.com/en/articles/17631495-get-started-with-claude-duet

2. Decisions API generally available (OpenAI)

- Official link: https://openai.com/index/decisions-api - Release date: 2026-10-22 - Key features: GPT-6 Luna via POST /v1/decisions for bounded answers (predicate probability, choice, or rubric score) from text, images, and structured JSON. OpenAI says up to 10x faster than GPT-6 Luna through the Responses API for these workloads. Since beta: prompt caching, native GPT-Live integration, US/EU inference residency, native JSON input, images in question instructions, up to 400 questions per request. - Our take: Aimed at high-volume routing/classification in agent loops where latency and cost compound. Pricing is input-only. Vendor-reported speed claims; no third-party latency study cited on the page. - Pricing: $0.10 per million input tokens; $0.01 per million cached input; no output-token charges (stated on the official page). - Sources: official link; https://developers.openai.com/api/docs/guides/decisions

3. OpenAI models on Google Cloud Model Garden (private preview)

- Official link: https://openai.com/index/openai-models-google-cloud - Release date: 2026-10-21 - Key features: OpenAI frontier models and Codex workflows coming to Google Cloud Model Garden. Google Cloud's post names GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna in private preview for select enterprise customers; Marketplace purchase with GCP commitment drawdown. OpenAI says GA is planned in the coming weeks and that Microsoft remains its primary cloud partner. Google Cloud also says OpenAI models will come to Gemini for business and Google Antigravity. - Our take: Choice for enterprises already on GCP; OpenAI's own page is lighter on named model IDs than Google Cloud's. Neither post published Google Cloud-specific regions, quotas, or prices in the pages we opened. - Pricing: Unverified for Google Cloud SKUs; buy via Google Cloud Marketplace per the announcements. - Sources: official link; https://cloud.google.com/blog/products/ai-machine-learning/google-cloud-brings-openai-models-to-customers

4. DHS FASCSA order on DeepSeek (US policy)

- Official link: https://www.govinfo.gov/content/pkg/FR-2026-10-20/html/2026-21447.htm - Publish date: 2026-10-20 (Federal Register notice FR Doc. 2026-21447) - Key features: DHS notice of a Secretary order under the Federal Acquisition Supply Chain Security Act: (1) exclude IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (and affiliates as defined) from federal civilian agency procurements; (2) remove DeepSeek and DeepSeek-affiliate products, and third-party products/services developed using DeepSeek implementations, from civilian agency IT. Contact: CISA FASCSA Order Implementation Team. Signed order in the notice appendix / regulations.gov docket DHS-2026-0628. - Our take: Binding for US federal civilian systems and procurements covered by the order. Scope details beyond the FR summary (e.g. DoD exclusion timing reported in press) are not treated as verified here. - Sources: official GovInfo HTML; FederalRegister.gov URL was CAPTCHA-blocked in our earlier checks

5. PHP2Shell / Patch the Planet (OpenAI + Wiz)

- Official link: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ - Publish date: 2026-10-21 - Key features: OpenAI describes coordinating a response to critical PHP engine vulnerabilities under Patch the Planet. Calif identified a critical flaw using GPT-5.6 Sol; Wiz independently discovered and reported both vulnerabilities; PHP maintainers led fixes and release, with partners including Wiz and Cloudflare. OpenAI also announces $1 billion in subsidized Daybreak access for frontline defenders. Wiz's parallel post names the issues PHP2Shell and groups bugs under CVE-2026-109618 and CVE-2026-109619. - Our take: Operational priority for anyone running PHP: apply maintainer patches. CVE/CVSS framing is from Wiz, not OpenAI's post. No exploit details beyond the public disclosure posts; we did not verify patches hands-on. - Sources: official link; https://www.wiz.io/blog/php2shell-php-rce

6. Storm-0940 and ARTEX (Microsoft Threat Intelligence)

- Official link: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ - Publish date: 2026-10-21 - Key features: Microsoft says China-state-aligned Storm-0940 used the open-source agentic AI pentest framework ARTEX as early as September 2026. It assesses Storm-0940 was responsible for the ConnectWise supply-chain compromise of a multi-tenant application; several ARTEX-driven attacks reached privileged cloud access in under 3 hours; after ConnectWise, the actor used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants. ARTEX: multi-agent LLM system in Go with a Next.js frontend. Microsoft says the activity did not result from a compromise of Microsoft corporate systems, products, or services. - Our take: Attribution and impact figures are Microsoft's assessments. Practical follow-up is ConnectWise containment guidance plus reviewing service-principal sign-ins and Graph activity in affected tenants. - Sources: official link

7. Infinity agent runtime (AWS + UC Berkeley)

- Official link: https://aws.amazon.com/blogs/opensource/introducing-infinity-a-runtime-for-extreme-agent-concurrency/ - Publish date: 2026-10-23 - Key features: Apache 2.0 research agent runtime (Hydro project) that suspends agents at tool calls (stackless-coroutine style), persists conversation state, and resumes when results/events arrive. AWS says ~75,000 concurrent idle agents fit in 8 GB (~100 KB per idle agent in their benchmark) and that waiting agents need no running compute—useful for serverless. Early research release on GitHub (hydro-project/infinity). - Our take: Interesting systems paper-as-runtime for long-wait agent workloads. Benchmark is vendor-reported; treat as research, not a production SLA. - Pricing: Open source (Apache 2.0); cloud cost depends on how you host it. - Sources: official link

8. Carbon-X (Hugging Face)

- Official link: https://huggingface.co/HuggingFaceBio/Carbon-X - Release date: 2026-10-22 (date from third-party coverage of the HF release; model card has no publish date in our fetch) - Key features: Open 14.8B decoder-only model trained jointly on DNA and natural language (Apache 2.0), starting from Qwen3-14B. Raw DNA in chat; variant-effect prediction; sequence explanation; DNA generation. Weights said to fit on a single 80 GB GPU in bfloat16. Model card: not clinically validated; should not be used for medical decisions; long DNA generation quality degrades. Collaboration with Zhongguancun Academy and TIGEM / University of Naples Federico II. - Our take: Vendor-reported average 66.7% across five DNA benchmarks (thinking disabled) vs GPT-6.1 Sol 67.5% on the same table; leads the vendor table on BioReason Coding (74.9) and NextBase (39.4). Research / bioinformatics tooling—not clinical use. - Pricing: Weights free under Apache 2.0 (self-host). - Sources: official model card

Also noted this week (tracker)

- OpenAI: frontier training moved to an offline cached web after a Sep 20 DNS escape (post, 2026-10-23). - Anthropic: Anthropic-managed Claude on Google Cloud GA; UK AISI Mythos 5 alignment assessment (both 2026-10-23). - Policy: UK AI security package including an AI Biosecurity Lab (2026-10-24); Texas AG suit vs OpenAI (2026-10-23); China's State Council AI employment guidelines (2026-10-23). - Others: Daytona $60M Series B; Block Dessa speech research preview; Moonshot Kimi K3.1 Pro (see Lab Tracker for official links).

This week's trends

1. Proactive / background agents: Claude Duet (user-facing waitlist) and AWS Infinity (open runtime for extreme idle concurrency) push the same theme from product and systems sides. 2. Bounded, cheap decisions in the hot path: Decisions API GA is explicitly for classification/routing latency, not open-ended generation. 3. Cloud choice expands: OpenAI models enter Google Cloud Model Garden in private preview while Microsoft remains OpenAI's primary cloud partner per OpenAI. 4. Security and policy pressure: PHP coordinated disclosure, Storm-0940/ARTEX supply-chain abuse, and the DHS DeepSeek FASCSA order landed in the same week.