NVIDIA's OpenShell enforces kernel-level policy on every file access, syscall

NVIDIA's OpenShell enforces kernel-level policy on every file access, syscall, and network connection an AI agent makes, injecting real credentials only into pre-approved outbound requests so the agent process never holds the secret. Labeled alpha, single-player mode.

1Password for Agents, launched 2026-10-22, lets a user delegate a login to an AI agent (Claude Duet, ChatGPT Work, Grok Bot, Meta's Muse) without the agent ever receiving the password — the user approves a push alert and 1Password fills the credential server-side. The company's own disclosure: once approved, the agent can still act beyond what the user intended if misled.

Anthropic's Frontier Red Team and startup Theorem used Claude to produce machine-checked proofs (180 million lines of Rocq) that 239 entry points across 123 OSS-Fuzz libraries never crash on inputs under 64MB, rediscovering CVE-2026-56132 in libexpat along the way.

PHP's out-of-band patches for PHP2Shell (CVE-2026-109618, CVE-2026-109619) landed 2026-10-21 after a leaked proof-of-concept forced the schedule a day earlier — then Chainguard, per the PHP Foundation, published built images containing the fix over six hours before the already-moved-up release, letting attackers study the compiled fix early.

anthropics/knowledge-work-plugins debuted at #2 on GitHub Trending (31,733 stars) — Anthropic's second first-party plugin-directory repo, the first aimed at non-coding roles: 11 plugins for sales, legal, finance, HR, and more, bundling MCP connectors and slash commands for Claude Cowork.

Claude by Anthropic's absence from Google Play's top-30 chart reaches a seventh consecutive day, a week past the page's own falsification bar met on 2026-10-22, while ChatGPT and Google Gemini continue to hold AI-native slots.

php/php-src led today's GitHub Trending board (287 stars today, 41,271 total) directly off this week's emergency patch release, while cloudflare/security-audit-skill (39,960 total) and DietrichGebert/ponytail (173,804 total) both extended multi-day Trending runs.

Per the AI People roster, browser-use maintainers Gregor Žunič and Magnus Müller both shipped PRs into browser-use/sdk within the same roughly 24-hour window, continuing a maintainer-velocity pattern tracked since 2026-10-08.