AI news, 23 October 2026: an agent standard changed owners, and two patch notices landed.

Anthropic gave the Agent Skills standard away to a Linux Foundation project it co-founded, handing over the name, the GitHub organisation and the domain along with the specification. The PHP project shipped emergency fixes for two unauthenticated remote code execution flaws, both scored 9.2, one day after warning administrators they were coming. Microsoft named a China state-aligned group that used an open-source agentic penetration-testing framework against more than 2,250 tenants and reached privileged cloud access in under three hours in several cases. Two of today's five stories are work for this week rather than reading. The other three are a 40-billion-parameter coding model you can run on a laptop under Apache 2.0, a monitoring product whose existence says how much GPU time is leaking, and a governance move that quietly admits what 280 million skill installations amount to.

Every date and figure below comes from the primary source linked in its section, except where a section says otherwise. AcquihireTech writes this roundup for Indian service businesses doing ₹10L+ a month, so each item is filtered through one question: does it change what you do this month? The window is 21 to 22 October. The note near the bottom lists what was cut and why.

1. Anthropic handed the Agent Skills standard to the Linux Foundation

What happened. On 22 October Anthropic published a post saying it is donating Agent Skills, the open standard that gives AI agents specialised knowledge and workflows, to the Agentic AI Foundation (AAIF) under the Linux Foundation. Anthropic co-founded the AAIF with Block and OpenAI the previous year and had already donated the Model Context Protocol to it; the post says the foundation provides “a neutral home to the standard going forward”. The donation is more than a specification: “We are donating the Agent Skills name and logo, the GitHub organization, and the agentskills.io domain.” On adoption, the post says “More than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot, and VS Code, have integrated Agent Skills”, and “So far, 1 million skills have been published and nearly 280 million installed.” Skills began in October 2025 as a Claude Code feature and were published as an open standard in December 2025. Engineers from Anthropic, Google, OpenAI and other companies will now maintain it as individuals, with David Soria Parra and Mahesh Murag named as Lead Maintainers. The proposed roadmap covers “versioned releases, a formal proposal process, and security guidance” for skill authors and installers. Anthropic adds that “You can continue to use the standard or contribute to it without joining the AAIF.”

Why it matters. A skill is a folder of written instructions. That is the entire technical content of the thing engineers from Anthropic, Google and OpenAI now co-maintain together in a neutral foundation, and it is worth sitting with. The layer being standardised here is the document that tells the model how your work is done, rather than the model itself. The number to look at twice is the installation count rather than the publication count: nearly 280 million installs, against a roadmap on which security guidance is still listed as proposed. An installed skill is text an agent reads and then acts on, usually with tools attached to it. That is a software supply chain running without the habits of one, no signing, no versioned releases yet, no advisory process. Putting it under the Linux Foundation is the right move and also an admission of what it has grown into.

What it means for a service business. If anyone in your team has written a document that tells an AI tool how your business does something, how to price a renovation quote, how to answer the eighth enquiry this week about timelines, that document is now a portable asset in a way a prompt pasted into a vendor's text box is not. Keep them as files, in a repository you control, named after the process rather than the tool. AcquihireTech writes client playbooks that way for an unglamorous reason: the tool gets replaced eventually, and the way a business qualifies an enquiry usually does not. The second job is an inventory. Ask which skills your agents currently load, and where each one came from. If nobody can answer that, the answer is the finding.

2. PHP shipped emergency fixes for two unauthenticated RCE flaws

What happened. On 20 October the PHP project posted advance notice of a critical security release. On 21 October it published the advisory with PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Two flaws, both rated critical at 9.2 under CVSS v4, both allowing unauthenticated remote code execution. CVE-2026-109618, “RCE via OOM corruption”, is a case where out-of-memory handling interrupts PHP while internal request data is only partly initialised, after which request cleanup can treat the invalid data as valid. CVE-2026-109619, “RCE via stale global state”, is a use-after-free: request-owned state survives in a persistent worker after its backing memory is freed, and a later request handled by the same worker reads the stale pointer before normal initialisation resets it. The advisory says every installation serving web requests is affected, naming PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and puts the risk highest on mod_php, with a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. Updating is the only complete fix. The interim measures it lists, including session.upload_progress.enabled=0, fatal_error_backtraces=0 on PHP 8.5, and tighter request size limits, “reduce exposure to specific attack paths but do not make an installation safe”. PHP 8.1 and older receive no updates from the project, though minimal source backports exist for 7.4, 8.0 and 8.1 in php-src branches named after the two CVEs, and PHP 8.2 reaches end of life on 31 December 2026. The GitHub advisories credit four reporters by handle, lcfr-hax, sagitzadik-wiz, tomash-areion and amyb-oai, and four remediation developers; neither advisory says what those handles refer to or how the bugs were found.

Why it matters. Secondary coverage has run hard on an AI angle: that one of these flaws was found with an OpenAI model, under a programme OpenAI calls Patch the Planet. That is not confirmed here, because openai.com returns HTTP 403 to every automated fetch from this pipeline, as it has on previous runs, so the company's own account of it could not be read at source. What is verified at primary sources is narrower and still the point. Two unauthenticated remote code execution flaws in the core of the language that runs a large share of the web were disclosed and patched the day after the project's advance notice, and the reporter list points at a cloud security vendor and a model lab rather than a lone researcher with a weekend. Whatever found them, better vulnerability discovery reaches a small business in exactly one form, as a shorter patch window, and this window was about a day.

What it means for a service business. One task, today, and it is a question for your host rather than a project: which PHP version is my site running, and has it been patched to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If the site is WordPress, that question is the same as asking whether the site is currently exploitable, and the answer lives with whoever controls the server, not with whoever built the theme. Two follow-ups worth writing down. If the answer is PHP 8.1 or older, the site is on a branch the project no longer updates and the fix is a version migration, which is a planned piece of work rather than a patch. If the answer is 8.2, the migration has a date on it already, 31 December 2026, which is about ten weeks out. Neither of those is an emergency this morning. The patch is.

3. Microsoft tied the ConnectWise compromise to agents moving in minutes

What happened. On 21 October Microsoft Threat Intelligence published an assessment that Storm-0940, a China state-aligned actor active since 2021, was responsible for the ConnectWise supply chain compromise of a multi-tenant application, and that it used ARTEX to do it. ARTEX, as Microsoft describes it, is an open-source penetration-testing framework that can run on any AI model: a multi-agent system written in Go with a Next.js frontend, which runs autonomous tests “from reconnaissance through data exfiltration” with little human interaction. The timeline in the report: between 10 and 14 October a password-spray campaign from a single address targeted 327 accounts across eight organisations and generated more than 151,000 failed logons, peaking on 11 October at 2,900 failures a minute, with no successful authentication observed in that campaign. Public reports of the ConnectWise Cloud Backup compromise appeared on 15 October with indicators matching the same network range, and ConnectWise published its advisory on 16 October. ARTEX-driven sign-in attempts reached more than 2,250 tenants, including over 200 sign-ins in under four minutes using four application credentials, and in several cases the time from initial targeting to privileged cloud access was under three hours. After taking control of identities for several ConnectWise cloud applications, the agents used stolen application credentials to authenticate into customer tenants with no interactive user sign-in, followed in some environments by reconnaissance and attempts to change credentials and privileges through Microsoft Graph. Microsoft states the activity “did not result from a compromise of or vulnerability in” its own systems or products, and that an affected application, or even a successful authentication, “does not necessarily indicate that customer data was accessed or exfiltrated”. Its guidance is specific. Keep affected ConnectWise connections disabled until ConnectWise issues formal restoration instructions, and do not delete the enterprise applications as a first step, because that destroys the evidence. Then inventory the affected application IDs and their service principal object IDs by application ID rather than display name, preserve sign-in and audit logs, review activity from at least 15 October and service principal sign-ins back to 1 October where records exist, and audit new credentials, owners, consent grants and privileged role assignments.

Why it matters. Nobody's password was the way in. The path was a vendor's application that customers had already granted consent to inside their own tenant, and once that application's credentials were taken the attacker needed no user at all, which is why the multi-factor prompt nobody received is not evidence of anything. The speed has no human equivalent: under three hours from first contact to privileged access, and 200 sign-ins inside four minutes. A response process that depends on somebody noticing something odd and raising it on Monday does not operate at that tempo. Read the limits of the report honestly, too. It establishes how far the attackers got and how fast; it does not say what was taken, and Microsoft is careful to say that a successful sign-in is not the same as stolen data.

What it means for a service business. There is a list in your Microsoft 365 or Google Workspace tenant that you have almost certainly never read: the third-party applications holding granted consent. The CRM, the scheduler, the invoicing tool, the AI meeting notetaker somebody trialled in March and forgot. That list, not your password policy, is the shape of this attack surface, because each entry is a key held by a company whose own security you cannot audit. An hour this week covers the useful part. Open the enterprise applications list and withdraw consent for anything nobody in the room can name an owner for, then write down, for each one that stays, what client data it could read if the vendor itself were breached. AcquihireTech asks for that inventory in the first hour of a Systems Audit, for the plain reason that a list nobody maintains is where the surprises sit, and a password policy was never going to cover it.

4. Recursive put a 40B coding model on Hugging Face under Apache 2.0

What happened. On 21 October Recursive Superintelligence published Flint, a mixture-of-experts coding model, with weights on Hugging Face under Apache 2.0 and a release post the same evening. The model card gives 39.8 billion total parameters with about 2.5 billion active per token, across 49 layers, two dense and 47 mixture-of-experts, with 256 routed experts, six selected per token, and an always-active shared expert. The card states a context window of 262,144 tokens; the blog post says up to 512k with 256k recommended for best results, which is a discrepancy worth knowing about before you plan around the larger number. The release evaluations are the company's own: 89.7% on SWE-bench Pro v2 and 74.2% on SWE-bench Verified, both with mini-swe-agent and no internet access, and 54.9% on Terminal-Bench 2.1 with Terminus 2, where solutions obtained through web retrieval count as failures. Agentic scores are average pass@1 over at least five attempts. Recursive says a small team built Flint in under four months, claims more than 125 tokens per second on an M4 Pro MacBook Pro and more than 150 on a 64GB NVIDIA RTX Spark at short contexts, and reports an NVFP4 quantised version scoring within 0.7 points of the 16-bit model. The serving kit targets one B300 or H200 GPU per replica with a checkpoint download of about 80GB, Transformers modelling code is not included yet, and the card warns the model “can still produce incorrect or harmful content, faulty code, or inappropriate tool calls”.

Why it matters. Treat the headline score as a claim, not a result. Every benchmark figure here is self-reported on the vendor's own harness, and 89.7% on SWE-bench Pro v2 from a model with 2.5 billion active parameters is precisely the sort of number that deserves an independent reproduction before anyone rebuilds a workflow on it. What needs no reproduction is the licence and the download size. Apache 2.0 weights that run at a usable speed on a laptop change a question that has nothing to do with capability: not what the model scores, but where the code goes while it is being read.

What it means for a service business. If you build or maintain software for clients, there is likely a clause in at least one contract that makes sending their source to a third-party API awkward, and a conversation you have been avoiding about it. A model that runs on the machine is a contractual answer before it is a cheaper one. The work this month is small and specific: take one real task you already pay an API to do, a test suite for a module you know well is a good candidate, run it locally with the weights, and compare the output to what you pay for now. Keep the subscription until that comparison exists on paper. A vendor benchmark is not a reason to cancel anything, and a result from your own codebase is.

5. NVIDIA launched a product for measuring wasted GPU time

What happened. On 22 October NVIDIA announced Minerva, an AIOps platform for operators of large GPU clusters. It combines infrastructure and workload telemetry into a dynamic knowledge graph mapping GPUs, SuperNICs, switches, cables and the jobs running across them, analyses billions of data points an hour using supervised and unsupervised machine learning, traces a slow job to its cause, and groups alert floods into incidents with likely root causes. It includes a native AI assistant that can connect to external agentic tools, and operators can either keep a person in the loop for fixes or wire it to automation through infrastructure APIs. The metric NVIDIA builds the product around is “AI factory yield”, which the announcement defines through GPU hours, goodput, cluster uptime and token production. IREN is named as already using it. Aolani, Bitdeer AI, IBM, Jio, Lambda, Quake AI and Tesla are named as planning to deploy it, and Dell Technologies, Lenovo and Supermicro will offer it within their AI factory portfolios. The claimed benefits are longer intervals between interruptions, faster time to repair and less alert noise, and the announcement publishes no quantified results for any of them.

Why it matters. The product is not for you and the metric is. A vendor does not build, name and sell a yield measurement for its own hardware unless the thing being measured leaks substantially, and the physics is unsentimental: one degraded cable in a cluster of a hundred thousand GPUs slows a job that is billed by the hour regardless. Jio is the one Indian name on that list, which is the detail worth filing: the operators building domestic capacity are shopping for the same yield tooling as the hyperscalers. Also note what is absent. A launch that claims fewer interruptions and faster repair without publishing a single figure for either is asking to be taken on trust, and the right posture toward an unquantified vendor claim is the same whether the buyer is a hyperscaler or a two-person marketing team.

What it means for a service business. Nothing to buy, and one idea to copy at roughly a millionth of the scale. You are paying per seat for AI tools and you almost certainly do not know your own yield. Pull every AI subscription off the card statement, count licences against people who actually opened the tool last week, and cancel the difference; that number is usually larger than anyone expects and it is the cheapest saving available this quarter. The second transferable part is the order NVIDIA built in: telemetry first, then a map of what depends on what, and automation only where a person had already agreed the fix. Reverse that sequence and you have automated a process you cannot see, which is the most common way an automation project quietly becomes the thing nobody will touch.

The window, and the stories we cut

Today's window is 21 to 22 October, and all five items fall inside it. All five were verified at a primary source opened during this run: Anthropic's own announcement, the PHP project's advisory together with both GitHub Security Advisories, Microsoft's threat intelligence report, Recursive's model card and release post, and NVIDIA's own launch post. Where a figure is the vendor's own claim rather than an independent result, the section says so: that applies to every Flint benchmark number, to NVIDIA's unquantified reliability claims, and to Anthropic's adoption and installation counts.

Five stories were cut. OpenAI's account of how the PHP flaws were found, widely reported and attributed to its Patch the Planet programme, is absent as a claim about OpenAI because openai.com returns HTTP 403 to every automated fetch from this pipeline; the flaws themselves are reported above from php.net and GitHub, which are primary. Walmart's Agent Gateway and Agent Profiles for AI shopping agents, reported by several outlets on 21 October, is absent because Walmart's own newsroom and news archive both returned zero results for it during this run, so the terms could not be confirmed at source. The Goa AI Policy 2026, reported as unveiled on 22 October at the Goa AI Tech Conclave, is absent because the state's Directorate of Information and Publicity carries no press release for it; the only official trace found was a social post about the conclave's inauguration, with the April draft policy the most recent document on the department's site. A “Claude Duet” research preview is absent for the second day running, because it still does not appear on Anthropic's news index, which was checked during this run. And Tesla's third-quarter results, circulating with a figure for how much its AI spending rose, are absent because no filing or company release for the quarter could be read; the most recent figures reachable were for the second quarter.

The short version of this edition: ask your host today which PHP version serves your site and whether it is patched, then open your Microsoft 365 or Google Workspace enterprise applications list and withdraw consent for anything with no named owner. Keep the documents that describe how your business works as files you own, not as prompts inside somebody's product. And before you cancel an API subscription on the strength of an open-weights benchmark, run one of your own real tasks locally and write the result down. If that audit turns up an integration nobody can account for, that is roughly where an AcquihireTech Systems Audit starts.