Today's Top Stories: October 24

Another busy day in tech, and it felt like AI was at the center of everything. Attackers used AI agents to hit thousands of online stores, while AI models found security holes that humans had missed for years. On the business side, Walmart handed shopping duties to robots, and OpenAI moved closer to a record-breaking funding round. Here are the six stories you need to know.

An AI Agent Army Attacked 1,200 Online Stores

Security researchers uncovered a scary new kind of cyberattack this week. A Chinese-speaking hacker used an open-source tool called Cairn to build a swarm of AI agents, then aimed them at more than 100 companies. The bots attacked over 1,200 e-commerce sites in the United States, Canada, Australia, and Japan, and kept going for 23 straight hours. Big names on the target list include John Deere, SharkNinja, and Cummins.

What makes this attack stand out is the price tag. Each breach cost the attacker only about $50 in AI tokens. That is pocket change for a corporate break-in. Researcher Snorre Fagerland traced the operation back to Cairn, a freely available tool that anyone can download.

So far the damage looks limited. John Deere said no sensitive data was stolen. SharkNinja confirmed only non-sensitive information was affected. Cummins is still checking whether a vendor system was hit. But experts warn that tools like Cairn make attacks like this easy for almost anyone to launch.

Why it matters: AI agents can now run attacks that used to need skilled hackers. Cheap, open-source tools let low-skill attackers cause serious harm at very little cost. Every company that sells online needs to prepare for bots that never sleep. (Source: NewsBytes)

AI Found Critical PHP Flaws That Could Hit Most of the Web

Artificial intelligence is now finding bugs that humans missed for decades. Experts are calling this week "Black October" after frontier AI models from OpenAI and Google discovered a chain of critical remote-code-execution flaws in PHP. The bugs are being called PHP2Shell.

PHP powers nearly 70 percent of the internet. WordPress and Wikipedia both run on it. A flaw this deep could let attackers run their own code on affected servers, so the scale of the problem is hard to overstate.

The response was immediate. The U.S. National Security Agency told organizations to patch or take vulnerable systems offline. Government websites in France, Finland, and the Netherlands briefly went dark as a safety move. Cloudflare reported exploit attempts surging into the millions. Node.js also rushed out emergency patches for four separate high-severity flaws, and India's CERT-In raised the alarm about cryptographic key problems at digital identity firm eMudhra.

OpenAI admitted the double edge of the discovery, saying the same capabilities that find these bugs can also help attackers build new offensive tools.

Why it matters: AI can now find holes in software faster than anyone can fix them. Patching is no longer a monthly chore. If your site runs PHP or Node.js, update today, because the exploit attempts are already climbing. (Source: The Sentinel Assam)

Walmart Lets AI Agents Do Your Shopping

Walmart just opened its doors to robot shoppers. CEO John Furner announced Agent Gateway at the Masters of Scale Summit on October 21. The tool is in developer beta and lets approved third-party AI agents search Walmart inventory and buy items at Walmart and Sam's Club.

The setup has guardrails. Each agent gets its own profile with spending limits, and the system can require manual approval before a purchase goes through. Bot purchases are kept separate from the customer's own shopping history, so a robot buying diapers will not mess up your recommendations.

Walmart is moving fast while others hesitate. Amazon has been blocking agent purchases, and U.S. banks have started detecting AI agent activity inside customer accounts. Walmart is betting that AI shopping is coming whether banks like it or not.

Why it matters: Online shopping is shifting from clicks to commands. You tell an agent what you need, and it does the rest. Retailers that welcome agents could win the next wave of commerce. If you use one, check its spending limits before you hand it the keys. (Source: TechRepublic)

Anthropic's Claude Duet Works While You Sleep

Anthropic launched Claude Duet, an AI assistant that keeps working when you are away. It watches your connected business apps and handles administrative tasks in the background without waiting for you to ask.

The tool is still in preview and requires human approval before taking consequential actions. Anthropic is offering it through a waitlist to Pro and Max subscribers in the United States. The idea is simple: let the AI do the busywork so you can do the thinking.

Claude Duet is part of a bigger trend. AI is moving from answering questions to taking action. Perplexity released a similar update this week, letting Mac users run full AI workflows locally on their own devices instead of in the cloud.

Why it matters: AI assistants are becoming co-workers, not just chatbots. If a tool can monitor your apps and act on your behalf, your job changes too. The winners will be people who learn to supervise AI agents instead of doing everything by hand. (Source: TechRepublic)

1Password Keeps Your Passwords Away From AI Agents

Password manager 1Password launched 1Password for Agents on Thursday. The new platform lets AI agents log into your accounts without ever seeing your passwords.

Here is how it works. When an agent reaches a login page, it sends a unique digital key to 1Password to prove its identity. You get an alert on your phone showing which account the agent wants and why. If you approve, 1Password fills in the credentials directly. The password never travels to the agent at all.

Launch partners include Anthropic's Claude Duet, OpenAI's ChatGPT Work and Dots, Meta's Muse, Grok Bot, and Town. The feature is included with eligible 1Password individual and family plans.

The timing is sharp. TechCrunch reports that U.S. banks have begun detecting AI agent activity inside customer accounts. Giving a chatbot your banking password was always risky, and now the security industry is catching up.

Why it matters: Agents need logins to do real work, but passwords should never leave your vault. This is the first big step toward a world where AI works for you without holding the keys to your life. Expect every password manager to copy this soon. (Source: TechCrunch)

OpenAI Nears a $30 Billion Raise at $1.25 Trillion

OpenAI is close to raising up to $30 billion at a $1.25 trillion valuation, according to CNBC. The round would be led by investors from the United Arab Emirates and U.S. firm Coatue. It would make OpenAI the most valuable private company ever.

The number is actually a step down. A month ago, reports said OpenAI was asking for $30 billion at a $1.4 trillion valuation. Some investors pushed back at the higher price, so the target dropped. Even so, $1.25 trillion is nearly 50 percent above the $852 billion valuation from the last round in March.

The money will go toward computing power. OpenAI has said it expects to spend about $600 billion on computing by 2030. The UAE deal may also include a separate agreement for more computing capacity. The company filed confidential paperwork for an IPO in June and could go public in 2027.

Anthropic is reportedly racing to list first, with rumors of a mid-November IPO at a $1.5 trillion to $2 trillion valuation.

Why it matters: Trillion-dollar valuations for private AI companies are now real. The AI race is really a computing race, and the bills are enormous. What these companies raise, and when they go public, will shape tech markets for years. (Source: TechCrunch)

Sources

• NewsBytes: AI swarm attack linked to Cairn hits 1,200 e-commerce sites
• The Sentinel Assam: AI-Fueled Black October and the PHP2Shell flaws
• TechRepublic: AI agents clock in: Walmart Agent Gateway and Claude Duet
• TechCrunch: 1Password for Agents
• TechCrunch: OpenAI $30B raise at $1.25T valuation