All editions
AI News6 items

AI News, Friday 23 October 2026

1. Cloudflare’s security audit skill for coding agents.

Install · Cloudflare’s open source security-audit skill is on top of GitHub trending today, with nearly 3,000 new stars in a day. It turns a coding agent into a security auditor that works in 6 phases: map the code, send separate agents to hunt for flaws, then hand each suspected flaw to a fresh agent whose only job is to prove it wrong. Only what survives goes in the final report, which cuts false alarms. Cloudflare says one run found about half of what repeated runs found. It needs Node.js and a sandbox. Install it with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit and run it on one of your own automation repos before a client asks how you check AI-written code. Source

2. Claude proved 123 open source libraries crash-free.

Know · Anthropic published research on 22 October showing Claude can do formal verification at scale: writing mathematical proofs that a program behaves as intended, not just testing it. With the startup Theorem, Claude turned existing fuzz tests into specifications, then proved that 123 open source libraries never crash on any input under 64 MB. The work produced about 180 million lines of proof and found hundreds of bugs on the way. For scale: the seL4 system took 20 person-years to verify by hand. Anthropic warns that “verified” is not “bug-free”, since the proofs only cover the modelled setup. Why it matters: it is a strong, concrete answer to clients who ask whether AI-written code can be trusted, and Anthropic also released a Claude skill to try it on your own code. Source

3. Agent Skills move to a neutral foundation.

Know · Anthropic is giving Agent Skills, the open format behind Claude skills, to the Agentic AI Foundation, the group under the Linux Foundation that already runs MCP. Since December 2025, more than 70 agent platforms adopted the format, including ChatGPT, Cursor, GitHub Copilot and VS Code. Anthropic counts 1 million published skills and nearly 280 million installs. Engineers from Anthropic, Google and OpenAI will maintain the standard, with versioned releases and security guidance for people who write and install skills on the roadmap. What it changes: a skill you write for Claude today is a safer bet, because no single company controls the format anymore. Source

4. OpenAI’s Decisions API is open to everyone.

Try · On 22 October, OpenAI opened its Decisions API to all developers, after a beta that started on 6 October. It does one thing: given a question and a set of options, it picks one and returns how confident it is, like a fast classifier. It runs on GPT-6 Luna and answers in about 100 to 180 milliseconds, against 1 to 3 seconds before, according to OpenAI. One request can now hold up to 400 questions, and images and structured data are accepted. For your automations, this is the right tool for sorting emails, routing requests or choosing an agent’s next step, where a full model is slow and expensive. Open the Playground and test it on one sorting step of an existing workflow. Source · Source 2

5. Quad9 leaves France on 24 November.

Know · Quad9 is a free, privacy-focused service that turns website names into addresses (a DNS resolver). A French court ruled on 21 October, in a case brought by beIN, that Quad9 must block sports piracy domains for users in France. Quad9 says it cannot spot French users without tracking them, and refuses to block worldwide. So it will stop serving France on Tuesday 24 November, and it says about 20 other cases are pending there. What to do: check whether your router, your Macs or a client’s network use Quad9, and switch to another provider before that date. Source

6. 12 AI models, the same “controversial” take on humans.

Know · ModelCompare asked 12 models, including Claude Opus 5.5, GPT-6.1 Sol and Gemini 4 Argon, for their most controversial take on humans, three times each. In 29 of the 35 answers, the take was the same: people put belonging, status or their own story ahead of truth. The 60 calls cost $1.54 in total. Why it matters: it is a cheap, live demo for a training on how alike models have become, and why asking two models is not a real second opinion. Source

Glossary

  • Formal verification: proving with mathematics that a program always does what its specification says, instead of only testing some cases.
  • Fuzz test: a test that throws huge numbers of random or strange inputs at a program to see if it crashes.
  • Agentic AI Foundation: a nonprofit group, founded by Anthropic, Block and OpenAI, that looks after shared standards for AI agents.
  • Linux Foundation: a nonprofit that hosts large open source projects so no single company owns them.
  • Classifier: a model that puts an input into one of a few fixed categories, such as spam or not spam.
  • DNS resolver: the service your device asks to turn a name like google.com into the numeric address of the server.