AI Brief, October 23: Agent Skills goes neutral, Nvidia OpenShell, Canva's image model

Anthropic donates Agent Skills to the Linux Foundation, Nvidia open-sources an agent sandbox runtime, and Canva ships its first image model.

The day's center of gravity was agent infrastructure: Anthropic handed the Agent Skills standard to the Linux Foundation's Agentic AI Foundation, while Nvidia published OpenShell, a policy-enforced runtime for fleets of autonomous agents. Elsewhere, Canva entered the image model race, 1Password shipped agent logins that hide credentials, and Microsoft researchers tied an AI-accelerated breach of ConnectWise to thousands of downstream victims.

Canva launches Craft, a two-stage image model that plans designs before rendering

The Verge reports that Canva released its first in-house image generation model, Canva Craft, which uses a two-stage architecture: it first interprets a prompt into a plan covering spatial relationships, relative scale, visual hierarchy and text, then generates an image at up to 2K resolution in more than 30 aspect ratios. Canva says it trained Craft on millions of human-made templates from its library rather than photographs, which it credits for legible text and precise object placement. TechCrunch reports the model is available to all users via the Dream Lab tab and through the Canva API, with MCP support planned for third-party chatbots including ChatGPT and Gemini. Canva says more efficient Craft-fast and Craft-ultrafast variants are coming.

Why it matters: It adds another production image API to evaluate against OpenAI, Google, ByteDance and Meta models, with a design-template training set that targets the text-rendering failures common in general image models.

Sources: The Verge AI / TechCrunch AI

Nvidia open-sources OpenShell, a sandboxed runtime for fleets of autonomous agents

Nvidia published OpenShell, an Apache 2.0 runtime that lets agents read files, install packages, call APIs and use credentials under a declared policy. Per the project README, it instruments the kernel to enforce policy on every file access, system call and network connection, and agents never see real credentials: OpenShell injects them only into requests bound for approved endpoints. Policy changes run through formal verification that flags risky new access, such as reaching a new host with credentials, and holds those changes for human review. Release 0.1.x adds new isolation primitives and APIs; it runs on Linux, macOS on Apple Silicon, or Windows with WSL 2, with Kubernetes deployment via Helm.

Why it matters: Teams scaling agent deployments get an off-the-shelf isolation and credential-brokering layer instead of rolling their own container plus secrets plumbing.

Sources: github.com / Hacker News discussion

Anthropic donates Agent Skills to the Linux Foundation's Agentic AI Foundation

Anthropic is donating the Agent Skills standard, including the name, logo, GitHub organization and agentskills.io domain, to the Agentic AI Foundation under the Linux Foundation, the same body that now hosts MCP. Anthropic says more than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, have integrated Agent Skills since it published the standard in December 2025, with 1 million skills published and nearly 280 million installed. Engineers from Anthropic, Google, OpenAI and other companies will maintain the standard as individuals, with David Soria Parra and Mahesh Murag as lead maintainers. The proposed roadmap covers versioned releases, a formal proposal process and security guidance for authoring and installing skills. Simon Willison notes he predicted the move back in December.

Why it matters: A SKILL.md folder is now on the same governance track as MCP, so investing in skills is less of a bet on one vendor's roadmap.

Sources: Anthropic / Simon Willison

Anthropic says Claude proved crash-freedom for 239 entry points across 123 libraries

In a collaboration with Theorem, Anthropic says Claude produced formal proofs at the RISC-V assembly level for 239 fuzz-test entry points across 123 open-source OSS-Fuzz libraries, proving the programs always exit normally without memory-safety errors or failed assertions for every input under 64 MB, assuming a single-threaded static binary with a fixed memory budget on Linux. The proofs total roughly 180 million lines of Rocq, with a typical proof around 600,000 lines over binaries with a median length of 18,000 RISC-V instructions. Anthropic says the process surfaced hundreds of bugs fuzzers were unlikely to find, including an out-of-bounds write triggered only by roughly 20 MB inputs with a rare layout and a rediscovery of CVE-2026-56132 in libexpat. The team is publishing a subset of proofs plus the RISC-V and OS semantics.

Why it matters: Formal verification has been limited to mission-critical code because of its cost; if LLM-generated proofs hold up, teams can get machine-checked guarantees on security-critical libraries without hiring specialists.

Sources: anthropic.com / Hacker News discussion

1Password launches agent logins that never expose the user's credentials

TechCrunch reports that 1Password launched 1Password for Agents, which lets an AI agent sign in to a user's personal accounts without ever receiving the credentials. When an agent attempts a login, a unique digital key is sent to 1Password to confirm the agent's identity, the user gets an alert and approves the request, and 1Password then fills the credentials on the agent's behalf. The company says supported agents include Anthropic's Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse, and agents from Town. The launch landed the same day Axios reported that U.S. banks have begun detecting agentic activity inside customer accounts and mostly cannot tell whether it was user-initiated.

Why it matters: It offers a concrete delegation pattern to copy: broker credentials behind a verified agent identity with a human approval step, rather than pasting secrets into an agent's context.

Sources: TechCrunch AI

Microsoft: AI agents drove ConnectWise breach that reached about 2,250 organizations

TechCrunch reports that Microsoft security researchers attribute a breach of ConnectWise's cloud backup service to China state-aligned hackers, who stole application credentials used to link ConnectWise with corporate customers and then logged into those customers' Microsoft-hosted environments as authorized users to read emails and files. Microsoft says the attackers used AI agents to hit around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute, leaving defenders what it called little time to detect and respond. The speed was attributed to ARTEX, an open source AI framework for stress-testing cyber defenses that was also used in a recent compromise of South Korean financial systems. ConnectWise has paused access to the cloud backup system and is working on restoring service.

Why it matters: Agent-driven attacks compress the window between credential theft and mass exploitation, which raises the stakes on token scoping, anomaly detection rates and rotation speed for any vendor integration you operate.

Sources: TechCrunch AI

How this brief is made: each morning, stories are picked from AI lab announcements, analysts, Hacker News, Hugging Face Daily Papers and the tech press, then summarized with AI assistance from the linked sources. Every item links to where its facts came from.