Welcome back! It's recap day, with this week's five biggest stories and five tools to try this weekend. Claude learned to work while you're away, and AI dug up decade-old holes in the code behind most websites. Banks found AI agents inside customer accounts. DeepSeek kept introducing itself as ChatGPT, and Claude cracked a 26-year-old NSA mystery in half an hour.
In today's Generative AI Newsletter:
Claude: What can Claude get done while you're away?
PHP: How did AI find decade-old holes in the code behind most websites?
Banks: Can your bank tell if your AI agent went rogue?
DeepSeek: Why does DeepSeek keep saying it's ChatGPT?
NSA: How did Claude crack a 26-year-old NSA mystery in half an hour?
Claude now works even when you're not using it
Anthropic launched Claude Duet, an assistant that works in the background and keeps you updated without waiting for you to start a chat.
It runs on its own cloud computer and asks before doing anything sensitive. For now, it's a waitlist research preview for Pro and Max subscribers in the US.
Then Anthropic said sessions in Claude's apps will run in auto mode by default starting next week, so Claude stops asking you to approve every step.
Claude is getting comfortable working without you.
AI found decade-old holes in the code behind most websites
Two critical flaws had been hiding for more than a decade in PHP, the code behind about 70% of websites. Wiz found them with help from AI models made by OpenAI and Google.
Cloudflare saw thousands of attack attempts before the bugs were even announced, then millions after. The NSA told companies to patch or go offline.
By the end of the week, people online were calling it Black October as one hack after another came out, from OpenCode to an Indian company with a secret key that was literally the number 4.
Nobody has confirmed a break-in through the PHP bugs yet.
Banks can't tell your AI agent from a rogue one
Big US banks are finding AI agents inside customer accounts, mostly logged in with the customer's own username and password. Even with your OK, that breaks most banks' rules.
One executive told Axios they struggle to tell whether an agent was sent by the customer or went rogue. Morgan Stanley has started blocking outside agents, and most banks are moving to read-only access.
Earlier in the week, Microsoft said even the best AI models can't be trusted, so it now treats AI agents like employees who could make mistakes or get hacked.
Chase's advice is to never give your username and password to anyone, AI included.
DeepSeek still thinks it's ChatGPT
Ask DeepSeek who it is, and it might tell you it's ChatGPT. One X user tried it 30 times, and DeepSeek called itself ChatGPT in 26 of them.
A fingerprint test going around online also claims DeepSeek's new model looks a lot like OpenAI's GPT-6 Astra. A chatbot getting its own name wrong doesn't prove it copied anyone, since the internet is packed with ChatGPT's writing.
Then the US ordered every federal civilian agency to remove DeepSeek, saying it could ship sensitive data to China.
If you use DeepSeek yourself, nothing changes for you.
Claude cracked a 26-year-old NSA mystery in half an hour
Much of the web's security runs on encryption built from numbers the NSA handed over in the late '90s with no explanation. People have wondered ever since if they hide a backdoor.
Claude figured it out in under half an hour. The numbers came from a basic random number generator, started from the computer's clock between May 1997 and April 1998.
Several Anthropic employees had chased a legend about an NSA joke phrase and gotten nowhere. Mid-solve, Claude wondered if it was stuck in a test, then double-checked the math.
Anthropic says a backdoor is now much less likely, and you don't need to do anything.
Top 5 tools of the week
Krea 3: An image editor that changes only what you ask for, with most edits back in under 8 seconds at 2K. Your product's label and logo stay sharp while the scene around them changes, and the free plan gets you about 5 images a day. For online sellers who need fresh product shots without booking a studio.
Sunra MCP: Puts image, video, music and 3D models inside the AI assistant you already use, like Claude or ChatGPT. Your assistant picks the model and writes the prompt, and Sunra charges what each model's maker charges, with no markup. Plans start at $12 a month. For anyone paying for a different app for every AI image and video model.
Teal: A free job search tracker with an AI resume builder built in. Its Chrome extension saves jobs from more than 40 job boards in one click, and it scores your resume against any job description and shows the keywords you're missing. For anyone still tracking job applications in a messy spreadsheet.
CodeRabbit: Reviews your code before it reaches production. Connect your GitHub or GitLab repo and it checks every pull request for bugs and security issues, then suggests fixes on the exact lines. For developers using AI to write code who want an extra set of eyes before shipping.
Bitdefender Scamio: A free AI chatbot that tells you if a message is a scam. Paste in a sketchy text or screenshot and it checks it against Bitdefender's threat detection. It works in your browser and inside WhatsApp and Messenger. For anyone who's ever gotten a text about a package they never ordered.
Learn more about AI from the experts building it
📸 Follow us on Instagram for fast, visual AI updates in 30 seconds.
📺 Watch us on YouTube to hear insights directly from leading AI voices, builders, and innovators.
🐦 Follow us on X for breaking AI news and real-time industry updates.
🧠 Learn how to build your next AI application with practical resources and expert guidance.
🎓 Start learning with free AI courses from GenAI Academy.
💰 Invest in the GTM infrastructure of the AI economy.
