Vibe Code Brief, October 22: OpenAI Models Land on Google Cloud

Today is about walls coming down: OpenAI walked its models into Google's cloud, a two decade old bug in PHP knocked over a chunk of the internet (and AI found it), Walmart opened its checkout to agents, and Anthropic shipped its own proactive agent. Four items, all from the last 24 hours.

1. OpenAI's models are coming to Google Cloud and Antigravity

Image: Google Cloud, via Google Cloud brings OpenAI models to customers

What happened: OpenAI announced that its frontier models are coming to Google Cloud's Model Garden in the coming weeks, transacted through the Google Cloud Marketplace so enterprise spend commitments apply. Reuters reports GPT-6 Astra is among them, alongside OpenAI's Codex development tools. Google also confirmed the models are coming to Antigravity and Gemini Agent.

Why it matters to designers and builders: your model choice stops being a cloud commitment. You can prototype on one vendor and deploy on the one your client's procurement team already pays for. Thomas Kurian's framing, "the right model for any given job," is exactly how agents and app builders should be architected.

What to do: if you build on Google Cloud, watch Model Garden. If you sell to enterprises, stop assuming OpenAI means Azure. And build model-agnostic, because this market just told you lock-in is dying.

2. PHP2Shell: AI found a bug that hid for 20 years, and the internet spent the day patching

Image: Google Cloud, via Responding to core PHP vulnerabilities

What happened: PHP and Wiz disclosed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, present in PHP 5.4 through 8.5 for roughly two decades. Wikipedia, 4chan, DeviantArt and even Pokémon Home went dark or wobbled, and Dutch and Finnish agencies took sites offline as a precaution. OpenAI says a security group found one of the flaws using GPT-5.6 Sol, and Wiz independently found them using AI. Fixes are out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Why it matters to designers and builders: PHP still runs 69.3 percent of sites with a known server-side language, including every WordPress site you ever shipped for a client. And the meta story is bigger: AI just found a vulnerability that sat past the edge of what human researchers could practically achieve. The same power finding bugs is already writing the code.

What to do: patch today. Update your runtimes, ask your host what version they run, and add "which PHP version" to your client site audit checklist.

3. Walmart's Agent Profiles: your AI will shop for you, approval first

Image: Walmart, via Making it possible for agents to shop on behalf of customers

What happened: Walmart announced Agent Profiles, rolling out next month, where a shopper's AI agent gets its own profile with required approval for purchases by default, spending limits, a separate purchase review, and an off switch. An Agent Gateway (beta) connects agents through the Model Context Protocol while sharing only what the task needs. Sam's Club is included. Meanwhile, The Verge notes Amazon is still blocking AI agents like Perplexity's shopping agent and Meta's Muse.

Why it matters to designers and builders: a top retailer just designed UX for a second audience: AI shoppers with rules, budgets and permission checks. If you build storefronts or marketplaces, agent access is now a design deliverable, and Walmart has published the pattern for free: scoped access, approval default, review trail, kill switch.

What to do: try it when it ships, and adopt the MCP pattern for agent-friendly commerce surfaces you own. Ignore the hype version ("agents everywhere") and keep the permission architecture.

4. Claude Duet, Anthropic's proactive agent, is live in preview

Image: Anthropic, via Claude Duet announcement

What happened: Anthropic launched Claude Duet, a proactive agent on Opus 5.5 that briefs you each morning, watches your connected apps all day, and asks approval before consequential moves. Research preview, US waitlist, Pro and Max tiers.

Why it matters to designers and builders: it is the newest data point in the interruption design race with Meta's Muse and OpenAI's Dots.

What to do: I wrote the full design breakdown, why the approval moment is the real story. Read that one before your next agentic feature.

Our take

OpenAI on Google Cloud kills the last excuse for vendor lock-in in your builds, and PHP2Shell is the week's reminder that the stack under every vibe-coded app is older and riskier than the prompt that made it. Walmart shipping permission-first agent commerce while Amazon builds walls tells you exactly which pattern to copy. Patch your PHP, and build model-agnostic.

Building something from today's news? Base44 gets your idea live fast. Want practice? Try today's Daily Vibe Code.

Related on NewForm

• OpenAI Just Put Up to $500 a Month of API Credits Inside Your ChatGPT Subscription
• United's CEO Vibe-Coded a Betting App Between Gym Sets. Here's What That Means for Designers
• A Vibe-Coded Site Got Hacked 6 Days After Launch. It Was Not the AI's Fault