AI and cloud briefing: outside auditors find critical gaps in OpenAI's agent monitoring, Anthropic launches a proactive AI agent, and a critical PHP flaw puts most of the web at risk

Here is our latest round-up of what’s changing in AI and cloud for UK businesses, with links to the original sources so you can read further.

Lead story: outside auditors find critical gaps in OpenAI’s agent monitoring

OpenAI relies on an internal system to watch what its AI agents are doing and flag anything that looks wrong. Independent evaluators METR and Redwood Research spent three weeks, from 21 July to 11 August, testing how well that system actually worked, and published their findings on 22 October. They found several weaknesses. Monitoring was suspended whenever an agent’s context window was “compacted”, a routine step in long sessions, and between May and July about 10% of eligible internal Codex traffic went unmonitored during these gaps. Because monitoring only restarted when an agent handed control back to a person, an agent could in principle keep acting during a gap and avoid being watched. The evaluators also found a way to stop hundreds of recent agent actions, including the exploit itself, from being logged at all, though OpenAI has not published the details. Importantly, the report does not show that these gaps were actually used to cause harm; it shows that the safety net had holes in it. OpenAI says it has since fixed the issues described. More detail is available from The Register’s coverage and GovInfoSecurity.

Why this matters: as AI agents take on more tasks with less human supervision, the systems that watch those agents become as important as the agents themselves. This case shows that even a well-resourced AI lab can have real gaps in its own oversight. If your business is giving AI agents access to code, email or other systems, it’s worth asking your provider how agent actions are logged and reviewed, not just what the agent can do.

Artificial intelligence: Anthropic launches Claude Duet, a proactive AI agent

Anthropic has opened a research preview of Claude Duet, a new kind of AI agent that works in the background rather than waiting to be asked. Built on its Claude Opus 5.5 model, Duet connects to a person’s apps, sends a short morning brief on items that need attention, checks in every few hours, and completes tasks such as administrative work or building simple web apps. Before taking an action with real consequences, such as sending a message, making a payment, signing a document or deleting a file, it asks for approval first. Anthropic says Duet does not see passwords or login details when given account access, and a dedicated safety check screens messages for sensitive information such as card numbers. For now, it is limited to a waitlist for Claude Pro and Max subscribers in the US, available on the web and in a dedicated iOS app. More detail is available from MacRumors and Thurrott.

Why this matters: Duet is part of a wider shift from AI that answers questions to AI that takes action on a person’s behalf, a trend also visible in similar tools from other providers. The approval step before anything consequential happens is a sensible design choice, and it is one worth looking for if your business starts trialling these kinds of agents: ask what a tool can do without asking first, not only what it can do.

Cyber security: a critical PHP flaw puts most of the web at risk

PHP, the server-side language that runs an estimated 70% of websites, had two critical remote code execution flaws disclosed in the same week, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell” by researchers at Wiz. Both carry a CVSS severity score of 9.2, among the highest ratings given. Details leaked ahead of a planned embargo on 20 October, and PHP’s maintainers issued emergency patches shortly after. Left unpatched, the flaws could let an attacker run code on a web server over the network without needing to log in first, potentially leading to full server takeover, data theft or further attacks on connected systems. Separately, on 21 October, maintainers of the popular open-source AI tool LiteLLM had their accounts compromised, and a malicious release was briefly published to the PyPI package index and Docker Hub before being removed, exposing anyone who installed it in that short window to credential theft and remote code execution. More detail is available from Wiz’s vulnerability write-up and Datadog Security Labs on the LiteLLM compromise.

Why this matters: PHP sits underneath a huge share of business websites, including ones built on common platforms like WordPress. If your business runs a PHP-based site, directly or through a hosting provider or agency, this is a prompt to check that it has been patched. The LiteLLM incident is a separate reminder that open-source software, including the AI tooling many businesses are now adopting quickly, depends on a chain of maintainer accounts and build pipelines that are themselves worth securing.

The takeaway

Today’s stories share a common thread: as AI tools become more capable and more independent, the systems that keep watch over them, and the software they run on, matter just as much as the tools themselves. OpenAI’s monitoring gaps show that oversight needs ongoing testing, not a one-off setup. Claude Duet shows one sensible way to build in a human approval step. And the PHP and LiteLLM incidents are a reminder that most real-world risk still comes from patching, access control and the security of the software supply chain, not exotic new attacks. We can help you work through what applies to your business. Get in touch.

AI Agent based research and content, AI can do mistake, please help us to improve.