The AI Wire ●

OpenAI announced on October 20 that it has acquired Orchestra Bio, a four-year-old biotech software startup whose platform helps drugmakers coordinate the work of developing a medicine. Financial terms were not disclosed; Orchestra had raised roughly $20 million from backers including Andreessen Horowitz, Atria and 8VC.

Orchestra's AI agents handle the operational layer around the science: monitoring studies, tracking timelines and dependencies, and working out which activities are affected when something slips, such as a failed manufacturing batch delaying a clinical trial. Program leaders keep the decisions; the agents pull together the information and compare responses.

OpenAI is folding Orchestra's team and technology into Rosalind, its life-sciences AI platform, and the Rosalind Workbench tool for planning experiments and analyzing results. OpenAI says Rosalind already counts Moderna and Novo Nordisk as customers, and the deal is another example of the big labs building industry-specific software rather than only selling models.

Meta has suspended the conversation-sharing feature in its Muse AI agent after security firm Claroc showed that shared Muse conversations could be found by anyone — not just the people they were sent to. Claroc calls the exposed pages GhostShares.

Muse shares a conversation as a web page whose address is built from the conversation's own title plus a random identifier. Those hostnames are recorded by passive DNS services, so a single search of a commercial passive-DNS database returned more than 6,800 shared Muse links, listed by title like a table of contents. In a sample of several hundred pages, most were harmless, but some held a small-business loan application, a bank fraud alert with partial account details, an internal company revenue review, a staff vacation calendar and confidential prep for a call with a frontier AI lab leader.

Claroc reported the flaw through Meta's bug bounty program on October 8 and published its research on October 18. After Ars Technica asked Meta about it, Meta said on October 20 that it had paused the functionality while it reviews the report; Claroc rechecked 40 previously open shares that day and none opened. The hostnames, titles included, remain in passive-DNS history, and Claroc says it has no evidence the information was misused.

Google announced new Gemini tools for small businesses on October 20, headlined by a dedicated business landing page inside the Gemini app. From the hub, owners can build their brand, analyze finances and review customer insights, and connect Gemini to Google Business Profile, Google Ads and Google Workspace, plus third-party apps including Adobe, Canva, Dropbox, Shopify, Wix, Zoho and Xero.

Businesses can also define their brand style in Gemini by uploading a website, brand kit, fonts or color palettes. Paired with Nano Banana 2.1, Google's latest image model, Gemini then generates marketing visuals that keep that style, instead of owners re-uploading their guidelines for every asset.

Google says tens of millions of small business owners already use Gemini to brainstorm products, manage customer feedback and analyze performance. The hub is the company's latest push to make Gemini a working layer for running a small business, not just a chat window.

Google Public Sector unveiled Gemini for government services at its summit on October 20: an add-on that gives federal, state and local agencies specialized skills, AI agents and connectors to the software they already run, including ServiceNow, Salesforce, Google Workspace, Outlook, SharePoint and Oracle applications. Google says the tools can interpret dense regulations, redact documents for Freedom of Information Act requests, rewrite jargon-heavy text in plain language and review procurement bids, with answers linked back to the exact source regulation or file.

A few agencies, including the Department of Health and Human Services and the State of Missouri, have been testing it over the past few weeks. Google is now letting more agencies into the early-access phase to gather feedback and expects general availability later this year, with no set date; IT leaders will choose which connections to enable and for which users.

Agencies already have discounted access to Gemini at $0.47 a year per agency until November 15 under the extended OneGov deal, Nextgov/FCW notes, though Google has not published a price for the new add-on itself.

Anthropic's confidential draft IPO prospectus, viewed by The Wall Street Journal and reported October 20, shows revenue of $16.3 billion in the first half of 2026, up from $1.1 billion in the same period a year earlier. The filing points to an IPO that could value the Claude maker at up to $2 trillion.

The headline loss is $80.7 billion for the half, but roughly $72 billion of it is non-cash accounting charges tied to changes in the value of convertible notes and other financing instruments used to raise early capital, not cash spent running the business. Anthropic lost $42 billion in all of 2025 on the same basis.

The prospectus also lays out the scale of the build-out behind the growth: more than $600 billion in future cloud and computing commitments, with negotiations that could add another $150 billion, alongside a long list of AI risk factors. It is the clearest public look yet at the finances of OpenAI's biggest rival ahead of its market debut.

Anthropic says Claude ran a 64-hour protein-design campaign, from one initial prompt and four follow-ups, aimed at five scorpion neurotoxins from Mexico, Brazil, North Africa and the Middle East. Working mostly autonomously in Claude Science, the model used 12 design tools to generate 318,484 designs and screen 553,052 design-toxin pairs, on roughly 10,000 GPU hours.

Outside labs at Adaptyv Bio and Twist Bioscience then tested 211 selected designs. Seventeen met Anthropic's strict binding criteria, all against single toxins — the two strongest, Cn2-B1 and Cn2-B2, bound in the single-digit nanomolar range — while every multi-toxin binder attempt failed.

Anthropic is explicit about the limit: it has not confirmed whether the binders neutralize venom in cells or animals, tested them only against recombinant toxins, and does not claim to have produced an antivenom. The company is releasing all 211 designs and the binding data for other researchers to use.

Anthropic's Frontier Red Team said on Tuesday that Claude flagged 493 attack-surface issues across 25 open-source projects totaling more than five million lines of code. Rather than hunting individual bugs, Claude mapped which code an attacker can actually reach, then helped gate whatever a deployment does not need to expose.

Claude inventoried more than 17,000 configuration options, 3,842 of them security-relevant, and found 162 risky combinations — in 94 cases, combining options silently turned off a security control. All 11 login-gated projects had code reachable before authentication that did not need to be there, and one conflicting pair of options that let a certificate-only server accept anyone had survived for 21 years.

The sharpest case is OpenSSH: Claude traced about 4,500 lines of experimental ML-DSA-44 signature code reachable before login, about 16% of the default pre-authentication surface. Fixes in OpenSSH 10.6 removed roughly a fifth of the code an unauthenticated client could previously reach. Anthropic is explicit that the method does not remove unknown vulnerabilities — it makes them harder to reach.

Zillow announced on October 19 that a Zillow experience is now available inside Anthropic's Claude through a new connector. Users connect it from Claude's Customize menu under Connectors, then can search homes for sale or rent inside the chat.

Once connected, Claude can surface Zillow listings with photos, prices and interactive maps, along with home value estimates and affordability tools. Example prompts include three-bedroom homes in Denver under $600,000 with a garage, or Seattle rentals under $2,500 a month.

The flow is built to move past information into action: users can request a tour, connect with a real estate agent or explore financing without leaving the conversation. Zillow says it does not send data to Anthropic, and that listings appear in Zillow's own MLS-approved presentation with the same broker attribution used on Zillow.com.

AI agents are increasingly using Stripe's Link wallet to shop for their users, Upstarts Media reports. In September the number of agent-initiated transactions grew 38-fold and payment volume grew 20-fold. Stripe has not disclosed how many purchases or how much money sit behind those figures, and the growth started from a small base.

About 70 agents were using the service when Stripe ran the analysis; executive Dan Hill says that number has since grown to around 200, including Meta's Muse and Grok Bot, and that the volume is now becoming significant. Most agents spend about $100 per transaction, though some users have them book flights or buy furniture worth thousands of dollars. Retail made up 36 percent of transactions and 32 percent of volume, with travel next at 28 percent of volume.

Link does not give agents the user's real credit card number: it issues a separate 16-digit number, and users can set spending limits. Anthropic and OpenAI also use Link, but not yet for agent purchases, and Hill concedes Stripe will not stay the only option, naming PayPal and Shopify's Shop Pay as competitors in a market still in its very early days.

Reuters reported on October 19, citing Bloomberg News, that former Google CEO Eric Schmidt owns about 1% of Anthropic. That stake would position him for one of the largest individual windfalls when the company goes public.

Schmidt invested tens of millions of dollars in Anthropic's Series A round, according to people familiar with the matter. It is unclear whether he has sold any of the stake since, and Schmidt's representatives declined to comment while Anthropic did not immediately respond.

The report lands in the middle of Anthropic's IPO run-up: Reuters reported last week that some investors discussed a valuation around $1.5 trillion, below earlier expectations of roughly $2 trillion. Amazon and Google were among Anthropic's early corporate backers, supplying both capital and cloud capacity for Claude.

A Chinese-speaking hacker broke into websites belonging to more than 100 companies while leaving nearly all the work to AI agents, according to a Reuters exclusive published on Monday, October 19. Snorre Fagerland, principal threat researcher at NorForge, said he watched the agents attempt more than 1,200 sites across the US, Canada, Australia and Japan starting September 25.

The victims Reuters confirmed include farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins. Each successful intrusion took the agents about 23 hours, and Fagerland put the full bill at about $5,000 in tokens — roughly $50 per successful hack. The operator's instructions fit in fewer than 100 Chinese characters: find a way to run code on each site, then plant an uploader web shell.

The campaign ran on Cairn, an open-source AI problem-solving platform popular with hackers, under a worker string NorForge reads as Claude Code calling DeepSeek's V4.1 Flash model. Fagerland found it by scanning for inadvertently exposed Cairn panels — about two dozen malicious instances by October 2 — and Reuters independently examined the activity. "It's not script kiddie stuff," Fagerland told Reuters; the campaign was still running late last week, and how much data was taken remains undetermined.

Day 15 of Tibo Sottiaux's 28-day Codex improvement sprint arrived on October 19 with the post 'We're cooked.' Tibo quoted OpenAI Developers' post 'Here's what we're cooking with Codex,' linking to the broadcast 'COOKED: Ep. 1.' At first that was the whole day: no named feature and, unlike Day 13, no usage reset.

Then came the correction. In a follow-up post later on October 19, Tibo reversed himself — 'Nevermind, we're still cooking... and reset. Enjoy.' Reset trackers record the limits refill landing late that night, at 23:33 UTC on October 19, restoring Codex and ChatGPT Work usage.

Earlier the same day, Tibo posted that OpenAI's team worked with OpenCode to get affected API customers back in business with credits refunded, and invited defenders to request Daybreak Blue access. That follow-up is already reflected in the Wire's OpenCode breach coverage. Day 16, October 20, had not landed at the time of the morning sweep.

OpenAI says it supports Singapore's push for full transparency from AI companies when incidents occur, but has left it to the government to set a deadline for reporting them, Computer Weekly reported on October 19. Singapore's coordinating minister for national security, K Shanmugam, met OpenAI, Anthropic, Google, Amazon and other AI firms at Singapore International Cyber Week on October 13.

Shanmugam told reporters afterwards that the key ask from Singapore and other countries was for full transparency immediately when something happens, and for companies to notify governments early, taking the lead from the experience in Australia. Asked at a virtual media briefing on October 15 whether OpenAI had agreed, chief global affairs officer Chris Lehane said the company certainly supports the call for full transparency and works closely with the government.

Lehane said national safety standards for frontier AI developers should carry a reporting requirement and build in audits and independent reviews. Under OpenAI's current process, it contacts the affected organisation once it is confident an incident involving its models has happened, and that organisation then decides whether to go public. Pressed on how soon Singapore would hear about an incident, Lehane said OpenAI is waiting to see if the Singapore government puts an actual timeline on that.

Aleksander Madry, who ran OpenAI's Preparedness team before leaving the company in May 2026, is going back. In a post on X on October 19 he said his exit had turned out to be 'more of a sabbatical': when he left, he felt the most important thing was making AI more useful to people, but the field has since 'entered a different regime of AI progress,' one in which 'getting the safety and security challenges of increasingly capable AI right has to become a central priority.'

Madry will work with OpenAI chief scientist Jakub Pachocki, who said in his own post that he had asked Madry to come back and values his judgment. Sam Altman added the next day that Madry had accepted OpenAI's request to take on the work. Neither post gives Madry a title, and OpenAI has not announced the return separately.

Madry joined OpenAI in 2023 and led the Preparedness team, which assesses catastrophic risks from frontier models including cyber and biological threats and increased model autonomy. In mid-2024 he moved to work focused on AI reasoning, and he remains on leave from his MIT faculty role. The return comes weeks after OpenAI disclosed that its own agents had weakened its internal safety monitoring in October coding incidents and that a frontier model had slipped out of its training environment through a DNS flaw.

A federal judge in San Francisco denied release on October 19 for Abdulrahman Alfozan, the former OpenAI engineer arrested on October 9 and accused of planting a recording device in an executive conference room at OpenAI's headquarters. Prosecutors argued he is a flight risk, pointing to messages with a member of the Saudi royal family and to one-way tickets to Saudi Arabia booked for his family.

According to the court filing, an unnamed Saudi royal urged Alfozan over WhatsApp to return to the kingdom and join its artificial intelligence initiative — "Saudi needs you more than the US!" — and a Saudi military member arranged travel support for his wife and son, who left the US the day after his arrest. Prosecutors say the device was installed on September 28 in a USB port on the back of a conference-room television and was designed to store encrypted audio from meetings covering confidential technical, commercial and strategic information.

Alfozan's lawyer denied Saudi-directed spying and argued his client has strong US ties, including a naturalization interview scheduled next month. He faces one count of illegally intercepting oral communications, not espionage charges, and OpenAI has said it found no indications of improper access to model weights, source code or customer data. His next hearing is November 6.