Anthropic previews Claude Duet, a proactive agent built on Claude Opus 5.5

OpenAI and Google Cloud announced on 21 October 2026 that OpenAI’s frontier models and Codex agentic workflows are coming to Google Cloud’s Model Garden. Google Cloud’s blog states that GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are rolling out in private preview to select enterprise customers on 21 October, and that developers can connect local Codex CLI and Desktop workflows directly to Google Cloud’s Gemini platform for inference. OpenAI’s post says general availability is planned in the coming weeks and notes that Microsoft remains OpenAI’s primary cloud partner.

Transactions run through the Google Cloud Marketplace, so OpenAI usage appears on a single Google Cloud invoice, draws down existing Google Cloud spend commitments and counts toward Flexible Savings Plans across model providers. Both companies say OpenAI models will also be added to Google Antigravity and Google Cloud’s Gemini Agent.

Google Cloud says the models run on dedicated Google Cloud infrastructure behind isolated gateways, VPC Service Controls and unified audit logging, with customer prompts and outputs kept inside the organisation’s data perimeter and never used to train foundation models. Zero Data Retention and Confidential Compute options are listed as coming later, and neither company published Model Garden token prices.

Anthropic launched an updated Claude Security in public beta for Claude Enterprise on 21 October 2026. Powered by Anthropic’s Claude Mythos model without requiring separate Cyber Verification Program access, the service connects up to eight repositories per project from GitHub.com, GitHub Enterprise Server, or other Git providers such as GitLab and Bitbucket using an authentication token.

When a project is created, Claude reads the code, writes an editable threat model and runs a deep baseline scan across files and repositories. As new commits land, it re-scans changes based on their risk and complexity rather than a fixed timer. Every candidate vulnerability goes through multi-stage adversarial verification and is rated Critical, High, Medium or Low against the project’s threat model. Engineers can open a finding in Claude Code to generate a patch, and Claude re-checks the repository when code changes to mark the issue fixed or reopen it if a regression appears. Findings can also be read and resolved through the Claude Security API, an MCP connector in Claude and Claude Code, or webhooks.

A separate Claude Security plugin for Claude Code is also in beta for teams that want to run scans inside their own environment using their existing Claude Code models. In the hosted app, Zero Data Retention is not supported; eligible Claude Enterprise organisations receive up to $25,000 a month in promotional credits for two consecutive months through 31 December 2026, after which usage is billed at direct token cost with no platform fee.

SpaceXSI announced on 21 October 2026 via its official @bot account on X that Grok Bot can now build reports, memos and dashboards as live pages. A user can ask Grok Bot to assemble a page around a topic or dataset, edit the resulting layout and text alongside the bot, or instruct Grok Bot to keep the page updated as new information arrives.

The launch video posted by @bot demonstrates Grok Bot generating structured memos and multi-section dashboards containing summary cards, tables, charts and written analysis, then revising sections in place from follow-up prompts and updating figures automatically.

SpaceXSI announced the feature on X without publishing a companion documentation page, pricing table or per-account rate limits.

OpenAI reported on 21 October 2026 that over the preceding two months it led a coalition of software maintainers, security researchers and infrastructure providers to patch critical vulnerabilities in PHP. Security researcher Calif identified a critical PHP flaw using GPT-5.6 Sol as part of OpenAI’s Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities.

PHP’s maintainers developed and released the upstream patches while OpenAI, Wiz, Cloudflare and other partners tested the fixes for bypasses, prepared web-application firewall rules and wrote operator guidance ahead of public disclosure. OpenAI also coordinated with U.S. and international government agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the Office of the National Cyber Director (ONCD) and the White House’s Super Intelligence Force, to reach critical-infrastructure operators. Based on the effort, OpenAI published a five-stage coordinated disclosure framework and a central guidance site at patchtheplanet.org.

Alongside the advisory, OpenAI released php2shell-checker on GitHub under the Apache License 2.0, providing a Node.js CLI and two Codex skills (phpcheck-url and phpcheck-server) that inspect HTTP response headers or local php -v output against the patched version cutoffs. OpenAI also noted its $1 billion commitment in subsidised Daybreak access for frontline defenders and Codex for OSS subscriptions for open-source maintainers.

OpenAI, PerturbAI and Scripps Research published a study on 21 October 2026 using thousands of parallel AI agents powered by GPT-Rosalind to interpret a whole-brain in vivo CRISPR Perturb-seq atlas spanning millions of mouse brain cells. Each agent examined a single gene disruption, analysed cell-type-resolved expression changes, searched scientific literature and wrote a structured report. The full run finished in 32 minutes, work the team estimated would take human researchers months to a year, and compiled the outputs into an open reasoning atlas with Codex MCP endpoints.

When the team compared one agent given the entire dataset against distributed agents at the same model and compute budget, the single agent cited only 11 literature references at the largest workload while the distributed agents cited more than 700. In blinded evaluations, human experts preferred the distributed-agent reports 75% of the time.

The agents highlighted two disease leads for follow-up lab experiments. First, while disrupting Tsc1 or Tsc2 had similar effects across most neurons, disrupting Tsc2 in the cerebellum altered dozens of neuronal-communication genes where Tsc1 produced little change, matching clinical links between TSC2 mutations and cerebellar symptoms in tuberous sclerosis. Second, disrupting DCTN1, a neuronal cargo-transport gene mutated in Perry syndrome, raised cholesterol-synthesis gene expression, pointing to cholesterol transport as a candidate mechanism in neurodegeneration.

Perplexity published a research paper and blog post on 21 October 2026 introducing Joint On-Policy Learning and Teaching (JOLT), a post-training method for reasoning, coding and agentic tasks. In standard On-Policy Self-Distillation (OPSD), one model acts as its own teacher by reading privileged context such as a verified answer, reference proof or test log, and the unprivileged student learns to imitate it token by token. Perplexity’s authors show that a stronger teacher can actually hurt the student if it relies on shortcuts that the student cannot reproduce without the answer key.

JOLT fixes that mismatch by training both roles jointly inside a single set of weights. The teacher learns from outcome rewards with a Kullback-Leibler (KL) penalty that keeps its token probabilities close to the student’s current policy, while the student learns from the teacher’s dense distillation signal on the student’s own rollouts. A second variant, JOLT+, adds the student’s own centred outcome rewards to the distillation update.

Across five benchmarks (GSM8K on DeepSeek-V2-Lite, MATH on Qwen3-0.6B, LiveCodeBench-V6 on Qwen3-8B, AppWorld on Qwen3-4B-Instruct and Terminal-Bench 2.1 on Qwen3-30B-A3B-Instruct), JOLT+ records the highest mean score in every setting, beating GRPO by 1.5 percentage points on GSM8K, 4.2 points on MATH, 3.0 points on LCBv6, 9.9 points on AppWorld and 4.5 points at pass@32 on Terminal-Bench 2.1.

On MATH, JOLT reaches 63.44% accuracy using 1.30 million processed training tokens compared with 8.40 million for GRPO, or 6.5 times fewer processed tokens and 13 times fewer completion tokens. Perplexity says it plans to open-source the code later.

NVIDIA announced the OpenShell Reference Architecture at GTC Berlin on 21 October 2026 alongside version 0.1.x of the open-source NVIDIA OpenShell runtime under the Apache License 2.0. Treating agent workloads as untrusted throughout execution, OpenShell separates governance into four components outside the agent’s reach: a Gateway control plane, a Sandbox that restricts filesystem and system-call access, an out-of-sandbox Supervisor that checks outbound network traffic and injects credentials only for approved endpoints, and a Policy prover that uses formal verification to check whether a policy change stays within an organisation’s ceiling.

The full-stack architecture pairs OpenShell with NVIDIA Vera Rubin NVL72 infrastructure for model inference, NVIDIA Vera CPUs (with 88 Olympus cores and up to 1.2 TB/s of LPDDR5X memory bandwidth) for running agent harnesses, and NVIDIA BlueField-4 DPUs running NVIDIA Sentry on DOCA to monitor behaviour out of band and quarantine out-of-bounds agents in milliseconds. The stack also extends to the edge on RTX Spark, DGX Spark and DGX Station systems.

In benchmarks run by CoreWeave on NVIDIA Vera CPUs against x86 servers, sandbox start-up was more than three times faster, supporting more than 11,000 concurrent agent environments in a single rack, and Terminal Bench agentic loops ran 1.8 times faster.

Companies working with the architecture include Anthropic, Amazon Web Services, Cisco, CrowdStrike, Google Cloud, Meta, Microsoft, OpenAI, Palo Alto Networks, Perplexity, Red Hat, SAP, ServiceNow and SpaceX Super Intelligence.