Claude Duet goes proactive, LiteLLM ships a credential stealer, Walmart opens the door to agents

Claude Mods — small TypeScript or JavaScript plugins that run inside Claude Code and hook into events — your prompt, a tool call, a screen render — so you can change what the agent interrupts you with and when. Anthropic ships six built in, and Claude will write new ones for you on request. It is the first credible answer to a complaint you hear on every engagement: the agent does plenty, but nobody can tell what mattered. Worth a caution to clients, though — mods are not sandboxed and run with your file permissions. The author's own Next Steps Supervisor fired on 99 of his 111 Claude Code turns, which he admits turns signal into background noise. Latent Space

Claude Security — an Anthropic service that watches your repositories as code changes rather than scanning on demand, keeps each finding open until the fix actually lands, reopens it if the bug comes back, and takes written context from your team about controls a scanner cannot see in code. A concrete answer for clients asking what agents can do in security beyond writing code, and the API plus MCP connector means findings can land in the workflow you already built instead of another dashboard nobody opens. Claude by Anthropic

Alter Vault — a Y Combinator-backed service that sits between your agents and the APIs they call: credentials stay in a vault and are injected per request, each agent gets its own identity and scopes, risky calls wait for a named human, and every call lands in an audit log. This is the shape of the control story clients keep asking you to draw on a whiteboard, now purchasable — useful whether or not you buy it, because it names the four things any agent access review should cover. It covers 140 integrations through one SDK call, and authorisation fails closed: if a policy cannot be evaluated, the request is denied. Alter Vault

LayerFS — a filesystem where each agent mounts its own throwaway workspace on top of shared committed history, does its work, commits what changed, and disappears — every file edit and shell command becomes a checkpoint you can rewind to or fork from. If you are advising anyone running several agents against one codebase, this attacks the problem at the storage layer rather than with yet more coordination prompts — and the branch-and-blame model gives you an audit trail per agent step. Dependencies stay inside every commit, so a workspace mounts in a claimed 0.05 seconds instead of a roughly five-minute reinstall, and a conflict rules file lets you name files, such as lockfiles and caches, where the newest edit simply wins. LayerFS

NVIDIA Agent Toolkit — an expanded open-source bundle for building enterprise agents, with a new knowledge layer that turns raw company data into business concepts an agent can reason over, a secure runtime that bounds what agents can touch, and reference blueprints. Clients drowning in data-platform choices will ask whether this replaces their RAG project; the honest answer is that it sits on top of what they already have, since NVIDIA stresses no data movement and no change to existing governance. NVIDIA's own supply chain organisation runs it through Palantir Foundry, and AWS, IBM, Oracle, Perplexity and ClickHouse are among those building on the knowledge layer. NVIDIA Blog

LiteLLM 1.107.0 — Someone pushed a malicious release of LiteLLM — the open-source gateway many teams use to route requests across model providers — to PyPI, carrying a credential stealer that grabs AWS, GCP, Azure, GitHub and LLM provider keys, plus SSH keys and shell history. Docker images carried it too. It was live for well under two hours before PyPI quarantined it. LiteLLM usually sits right beside a client's most valuable credentials, so this is the week's 'go check your build machines' item; the stealer runs every time Python starts, whether or not the project uses LiteLLM at all. The bad version went up at 11:39 UTC on 21 October and was quarantined by 13:20 UTC; the last safe release is v1.106.2. LiteLLM's maintainers believe the attacker reached an internet-exposed internal deployment, pulled GitHub CLI tokens out of its logs, and used them to drive the release pipeline. Wiz saw stolen AWS credentials being tested about four and a half hours after exfiltration. Wiz

Walmart Agent Gateway — Walmart launched an MCP server that lets approved AI agents search its inventory and buy on a customer's behalf, days after Amazon started blocking agents from making purchases. It comes with agent-specific terms, and agents that break them get blocked. The clearest live example yet of a retailer picking a side on agentic commerce, and the control model is one you can lift wholesale: Walmart compares it to adding an authorised user to your credit card. Agent Profiles arrive next month, giving each agent its own profile, separate purchase visibility and either per-transaction approval or a spending cap; no Walmart+ membership required, and the returns process still applies when an agent misbehaves. TechCrunch

Anthropic IPO prospectus — A draft prospectus described by the Wall Street Journal has Anthropic planning to spend as much as $750 billion on compute and already sitting on roughly $450 billion of mostly non-cancelable cloud commitments stretching seven to ten years, against a possible $2 trillion listing valuation. This is the number your clients will quote back at you when asking whether to standardise on Claude; the useful counterpoint is that most of those contracts cannot be walked away from, so vendor pricing pressure is unlikely to ease soon. Cloud commitments break down as $111 billion with Google Cloud, $110 billion with AWS and $31 billion with Microsoft. The filing reports a net loss of $80.7 billion for the six months to 30 June 2026, around $72 billion of it accounting charges rather than cash, while sources put the company at adjusted profitability in the third quarter. Risk factors listed include self-preserving model behaviour and outputs that resemble blackmail. Techstrong.ai

OpenAI on Google Cloud — OpenAI's frontier models and its Codex coding agent are coming to Google Cloud enterprise customers, who will be able to buy them through the marketplace and draw down existing cloud spending commitments. Procurement friction is often the real blocker on agent rollouts, and this removes one: a regulated client already committed to Google can now buy Codex without a new vendor contract. OpenAI's exclusive deal with Microsoft lapsed in April; it added AWS and now Google, covering all three big clouds. Anthropic's own filings say cloud marketplaces were 47% of its 2025 revenue, which shows why this channel matters. Techstrong.ai

Meta Muse share links — Researchers at Claroc found that Muse's shared-conversation links put the conversation title into the web address itself, which public DNS records then make searchable. They collected 6,800 links and, in a few hundred they opened, found a loan application, an internal revenue review and a staff holiday calendar. Meta has suspended sharing while it reviews the report. A clean cautionary tale for any client building a share feature on top of an agent: the leak was not a model failure or a prompt injection, just a URL design decision meeting a public logging system. Claroc reported it through Meta's bug bounty on 8 October and, says its CTO, heard nothing back before publication; the same product had a zero-day three weeks after launch that let any app on the same device take over an account. Ars Technica

DeepInfer — DeepSeek released DeepInfer, the software that serves its models in production, under Apache 2.0, with day-one support for both Nvidia's SM100 data-centre GPUs and Huawei's Ascend 950 accelerators. It runs one model for now, DeepSeek-V4.1-Flash. Clients weighing self-hosting will hear about this; the honest read is that it is a very detailed look at how DeepSeek keeps serving costs down, not a drop-in server — and the Huawei parity is a geopolitical signal worth noting the same week US civilian agencies were told to remove DeepSeek. Three things needed for a real service are missing from the release: the KV cache system, prefill/decode separation, and load balancing across replicas. Published performance charts were measured on Nvidia hardware only. GitHub

Orchestra Bio — OpenAI acquired Orchestra Bio, a four-year-old startup whose agents track the logistics of drug development — studies, timelines, clinical trial scheduling, finances — and is folding the team into Rosalind, its life-sciences line. Terms were not disclosed. Note the target: not the scientist at the bench but the programme manager coordinating across departments. That is the same shape of opportunity you see in other regulated industries, and a useful example when a client asks where agents actually earn their keep. Orchestra had reportedly raised around $20 million, from backers including Andreessen Horowitz and 8VC. OpenAI's framing leans on one figure: roughly 10 to 15 years from target discovery to US approval. No benchmark, customer result or product timeline was published. explainx.ai

Qwen3-Coder case study — Security firm Hirundo published a case study, by Ben Luria and dated 21 October, arguing that Qwen3-Coder produces less secure code when the task is framed as being for a US persona, and describing their mitigation. Open-weight Chinese models are in plenty of client stacks on cost grounds, and this is the kind of claim that will reach a CISO before it reaches you — worth reading the method before repeating the headline. It follows earlier Hirundo work on measuring geopolitical alignment in Chinese open-weight models, published on 5 October. Hirundo