In partnership with
Welcome back to The AI Field. Two flaws had been sitting in the software behind most of the web for over a decade. This month, AI models helped researchers prove they could be used to take over a website. The fixes came out on Wednesday, and attackers were already trying them.
Inside: what that means if you run a site or a shop, Anthropic's new agent that keeps working while you're away, and Walmart's rules for AI that shops for you. Plus five tools and a five-minute way to find out where your phone number leaked.
In today's AI Field:
AI finds a hole in the software behind 70% of websites
Claude Duet keeps working while your phone is off
Walmart opens its doors to AI shopping agents
Plus: five tools, three quick hits, and a five-minute way to find out where your phone number leaked.
Read time: 5 minutes
100+ coding prompts top engineers use to ship 5X faster
Claude Code, Codex, and Cursor are on every engineer's tech stack. Most still treat them like a search bar and get average output back. Top engineers work from a system instead. These 100+ prompts are that system.
Sign up for The Code and get:
100+ ready-to-use prompts built on real Claude Code, Codex, and Cursor workflows, so you ship in minutes instead of hours
The Code newsletter (5 min daily) to keep sharpening your AI-coding edge after the prompts land
LATEST DEVELOPMENTS
PHP · CYBERSECURITY
The AI Field: Researchers using AI models from OpenAI and Google found two critical flaws in PHP, the programming language behind roughly 70% of websites, including every WordPress site. PHP released the fixes on Wednesday, and the NSA told site owners who can't patch right away to take their sites offline until they can.
The details:
The flaws, nicknamed PHP2Shell, let an attacker run their own code on a web server without logging in, or read passwords, tokens and keys from its memory. Wiz says every PHP version from the last decade is affected by at least one of them.
Security firm Calif found one using OpenAI's GPT-5.6 Sol. Wiz, Google's security company, used its own AI agent with Gemini 4 Argon and GPT-5.6 Sol. PHP's team saw early signs of the problem in 2024 but found no way to exploit it; Wiz says AI made the hard part practical.
Attacks started fast. Amazon's security team spotted an attempt on October 17, four days before the fixes went public, and says PHP2Shell is now "broadly exploited in the wild."
Why it matters: If you have a website, a blog or an online shop, check this today. The fix goes on the server, so WordPress plugin updates won't install it. Ask your hosting company whether your server now runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Version 8.1 and older no longer get fixes at all. The same AI that found these flaws helps attackers turn a fresh fix into a working attack within hours, so waiting a week is no longer safe.
TRY THIS TODAY · 5 MINUTES
Find out where your phone number leaked and ask to be taken off the lists
Asked to do something about spam calls, one person's Grok Bot worked out roughly when their number was first used, tracked down the lists it had most likely leaked from, mostly insurance quote sites, and drafted a removal request to each one.
1. Open an AI assistant that can search your email. If yours can't, search your inbox for your phone number yourself and paste the senders and subject lines into the chat.
2. Paste this and fill in your number:
"I get a lot of spam calls on [NUMBER]. Search my email for websites and forms where I gave out this number, especially quote and comparison sites. List the likely sources, then draft a short removal and do-not-contact request for each one. Show me the drafts before sending."
3. Read each draft, fix anything that's wrong, and send only the ones you agree with.
ANTHROPIC · AI AGENTS
The AI Field: Anthropic opened a research preview of Claude Duet, an agent app that sends you a morning brief, checks your connected apps every few hours and messages you only when something needs you. It's Anthropic's answer to Meta's Muse and OpenAI's Dots, built for professionals and small business owners.
The details:
Duet runs on its own virtual computer with a browser, so tasks keep going when your laptop and phone are off. It carries over your Claude memory, skills and connected apps, on iPhone, Android and claude.ai.
Before it sends a message, makes a payment, signs a document or deletes anything, it shows you exactly what it's about to do and waits for your OK. A new filter blocks it from sharing card numbers and ID numbers.
It's a waitlist for Pro and Max subscribers in the US, and it uses your plan's normal usage limits. Anthropic says it "might misread a thread or miscalibrate what's urgent" and is weaker at personal errands like booking tickets.
Why it matters: The pitch has moved from an assistant you ask to one that comes to you. That only works if it interrupts you for the right things. If you get in, tell it what you want to hear about and how often, then count how many of its messages in the first week were actually worth reading. Outside the US, you'll have to wait.
Stop typing AI prompts. Start talking.
You think 4x faster than you type. So why are you typing prompts? Wispr Flow turns your voice into ready-to-paste text inside any AI tool. Speak naturally, tangents and all, and Flow cleans it up. Available on Mac, Windows, iPhone, and Android.
WALMART · AI SHOPPING
Image: Walmart.
The AI Field: While Amazon blocks AI agents from buying on its site, Walmart is inviting them in. Its new Agent Gateway lets approved agents search and buy at Walmart and Sam's Club for you, within limits you set.
The details:
Agent Profiles, rolling out next month, give each agent its own profile in your account. By default every purchase needs your approval, or you can let it shop within a budget, like up to $100, and see its orders apart from yours.
Agents get only what they need for the job. They can't touch your payment details or see your full shopping history, but Walmart can still point them to your usual bread or milk.
New rules say agents can't go beyond what you meant, and normal returns apply even when an agent gets it wrong. Agents that break the rules get blocked. No Walmart+ membership needed.
Why it matters: Shopping is already a big use for these agents: Meta says over a quarter of Muse's regular shoppers spend more than $200 per order on average. Walmart's rules make a good checklist for any store or agent you try: approval by default, a spending cap, a separate order history and clear returns. If one is missing, keep the agent on approve-every-purchase.
TRENDING AI TOOLS
Five tools you can try today, most launched or updated in the past few days. Click a name to open the tool.
🎨 UseIt Studio: Describe a sticker, pin, card or gift box in one sentence. This AI design studio asks what a designer would ask, then gives you an editable file with real sizes and cut lines, ready to print. Works in your browser or as a Windows app.
🎙️ TwinMind: The meeting notetaker now runs on Mac and Windows, transcribing calls in over 140 languages and letting you dictate into any app. Free plan; Pro is $11.99 a month.
🗺️ Google Maps: Gemini now works in Google Maps on Apple CarPlay. Tap the Gemini icon on your car's screen to ask for a place to stop, follow up with questions and route around tolls, hands-free. Live in the US, rolling out elsewhere.
📒 Notion Agent: Notion rebuilt its agents to work on a task for hours, with a Review for me mode before changes land. A new Auto setting picks a cheaper or stronger AI model per task. Free workspaces get limited trial use.
🧪 SellTo.us: Test an idea for a product, service or ad on up to 100,000 AI-simulated customers and get a report on who's interested and what puts them off. A useful first filter, not a replacement for real customers. First test free.
QUICK HITS
📈 Meta will sell a new class of shares to pay for AI: The non-voting stock starts trading in 2027, and Meta now expects to spend $135 billion to $145 billion this year. Mark Zuckerberg said over 10 million people have set up Muse, and about a quarter use it daily.
📢 ChatGPT ads reach 89 countries: OpenAI added 26 more on Wednesday, including Argentina, Nigeria, Ukraine and Pakistan. Ads show only on the Free and Go plans, and more than 100,000 advertisers have used them.
🏦 Barclays plans to cut 5,000 jobs: That's about 5% of the bank's staff, with roughly 60% of the cuts in support roles, as it leans on AI to run leaner.
That's it for today!
See you soon,
Olle Hellman | Founder of The AI Field