AI News, Oct 22: AI Found the Hole in 70% of the Web
The Big Story: the bug was 20 years old, the tools that found it were not
Wiz Research published the technical disclosure of two unauthenticated remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, at a severity Wiz puts at “reaching CVSS 9.2.” Its own summary is the part that stops you: “Nearly every PHP version is affected by at least one of these issues, including releases dating back to PHP 5.4.” Patched releases landed the same day, the fix is PHP 8.5.12, the NSA advised pulling unpatchable sites offline, and PHP runs roughly 70% of the web. Wiz credits its tooling without hedging: “We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research.” Security testing company Calif found one of the flaws with GPT-5.6 Sol under OpenAI’s Patch the Planet initiative; Wiz found and reported both independently.
The hinge is Wiz’s own warning about what happens next. What kept a decade-old class of bug from being farmed at scale was the tedium of adapting an exploit across versions, configurations and memory layouts, and Wiz says models erase that: it “significantly lowers the barrier to scaling attacks across different deployments.” Microsoft supplied the working example the same afternoon, attributing the ConnectWise supply-chain compromise to China-aligned Storm-0940 running ARTEX, an open-source penetration testing framework that works on any model and executes “an autonomous penetration test from reconnaissance through data exfiltration” with little human involvement. Microsoft logged sign-in attempts against more than 2,250 tenants peaking at 2,900 a minute, an October 10 to 14 password spray against 327 accounts at eight organizations with over 151,000 failed logons, and in several cases under three hours from first targeting to privileged cloud access.
Then the AI supply chain took its turn as the target. LiteLLM 1.107.0 shipped a credential stealer and a backdoor through PyPI, Docker Hub and GHCR, installed as a .pth file and a sitecustomize.py so they run when any Python process starts on the host, including one that never imports litellm. What it was built to take includes SSH keys, cloud and CI/CD secrets, Claude Code, Cursor, Copilot and Codex tokens, and the provider API keys sitting in a LiteLLM proxy database. The attacker got in holding the GitHub CLI credentials of three developers, believed lifted from logs of an internet-exposed internal LiteLLM deployment, and it is the project’s second compromise. The one sober measurement of the day came from Trail of Bits, which co-runs the Patch the Planet initiative with OpenAI and counted what agent-written patches cost: 21 confirmed regressions across more than 130 merged patches, none breaking a security protection. Its CEO was blunter in the comments: “We’re staring down the vulnpocalypse we predicted earlier this year,” and, on the day OpenAI proposed a five-stage disclosure process, “coordinated disclosure serves little purpose now.” The same capability turned up three times in one day: finding the bug, scaling the exploit, and harvesting the keys to the tools that do both.
Everyone shipped an agent that can spend money, and the banks said no
Anthropic put Claude Duet into research preview, a proactive agent on mobile and the web that sends a morning brief, re-checks connected apps every few hours and messages you when something needs a decision. It runs on Opus 5.5, is waitlisted for US Pro and Max subscribers, reaches more than 6,000 connectors and plugins, and buys things through Stripe’s Link flow with a spending authorization request. The guardrails are the interesting part: approval before it sends a message, pays, signs an agreement or deletes anything, and a hard bar on securities transactions and transfers between financial accounts even when the user authorizes them. Anthropic also concedes it checks every few hours rather than continuously because tighter monitoring burns plan limits, that it can misjudge urgency, and that it cannot yet show you its browser.
Meta put the first real numbers on the category the same afternoon, and they are not flattering. On the Q3 call Zuckerberg said more than 10 million people in the US and Canada have set up Muse, about 25% of them use it daily, and over a quarter of engaged users who shop through the agent average more than $200 a purchase. He also called Muse highly unprofitable. Walmart opened the till: Agent Gateway is an MCP server letting approved agents search inventory and buy on a customer’s behalf, with Agent Profiles arriving in November to give each agent its own profile, its own visible purchase history and either per-transaction approval or a spending cap, which Walmart compares to adding an authorized user to a credit card. Amazon is doing the opposite and blocking purchase agents, Meta’s included.
Finance spent the same day pushing back from the stage at Money20/20. PNC chief executive Bill Demchak said agent-only bank transactions “will never happen” and that anyone who tries it “they’ll be defrauded,” adding that he wants more friction, not less, and a liability shift from tech companies first. FDIC chair Travis Hill, same event, called depositors delegating rate-chasing to agents “the big thing that we’re thinking about”, with the open question being how many of them do it and what it does to the deposit landscape. PYMNTS puts the gap in the same place: nearly 45% of people who shop with AI have bought from a store they had never used before, so the trust problem is not recommendation, it is checkout.
Today’s Top Stories
Meta’s AI bill is mostly not on its balance sheet
Revenue was $64.60 billion, up 26%. Total costs and expenses rose 68%, of which a $9.89 billion charge for the August agreement with 52 state attorneys general is only one piece; operating margin halved from 40% to 20% and free cash flow came in at negative $2.12 billion. The figures that matter are in the 10-Q: $454.52 billion of non-cancelable contractual commitments as of September 30, of which $121.41 billion falls due in 2027, plus roughly $355.73 billion of operating and finance leases that have not yet commenced, running out to 2036. Meta’s answer to paying for it is a new publicly listed, non-voting Class C stock, approved by the board and issued as a one-time dividend effective January 19 2027, which CFO Susan Li said preserves the voting power of existing shareholders and the founder-led structure. A quarter of negative free cash flow is survivable; a commitment schedule that runs to 2036 is the thing to watch.
DeepSeek raised about $15 billion two days after being thrown out of US agencies
Bloomberg reports the Hangzhou lab closed roughly $15 billion, about 100 billion yuan, with CATL and Tencent among the potential investors and no valuation disclosed. It raised more than $7 billion at a $50 billion valuation in June. The timing is the story: the round landed two days after the US ordered federal civilian agencies to strip DeepSeek technology out of their systems, and a China IPO is reportedly on the table for next year. Being banned from the US government turned out to be a fundraising event.
A 31-year-old conjecture fell to about a hundred agent runs
Microsoft Research announced a proof of the Kannan-Lovász-Simonovits conjecture, posed in 1995, bounding the KLS constant by a universal constant independent of dimension. Xinzhi Zhang and Zhao Song got there by running multiple agents on variations of one idea in parallel while a human pruned the tree and fed the best branch forward, roughly a hundred research trajectories before it broke; agents also handled derivations, manuscript preparation and internal proof checks. The caveat Microsoft published alongside it is the one worth keeping: a separate unguided attempt with several leading models fell short. The result is not a model doing mathematics on its own, it is a researcher getting a hundred shots at an idea instead of a handful.
Recursive’s Flint is a laptop coding model its maker says AI mostly built
Richard Socher’s Recursive released Flint under Apache 2.0 on Hugging Face: a mixture-of-experts model with 39.8 billion total parameters activating about 2.5 billion per token, and around 131 tokens per second on an M4 Pro MacBook Pro against 58 to 69 for Gemma 4 and Nvidia’s Nemotron 3.5 Lightning on the same machine. It reports 74.2% on SWE-bench Verified and claims to beat every model under 50 billion parameters there. The provenance is the pitch: a small team built it from scratch in under four months, with Recursive’s automated research system contributing a sparser architecture, low-bit training that cut the model 71% with almost no quality loss, and custom kernels. Every number is vendor-reported with no independent evaluation yet, which is the whole difficulty with recursive self-improvement as a marketing claim.
Barclays is cutting 5,000 jobs and naming the technology
The bank will shed about 5,000 roles, roughly 5% of its staff, by the end of 2026, around 1,000 of them already gone in the first half. The cuts fall mostly on operational and functional positions, and Barclays says it needs fewer developers too. Group chief executive CS Venkatakrishnan tied it directly to “the investments which we’ve made into technology over a number of years and which we continue to make.” Plenty of banks have credited AI with efficiency gains in the abstract; this one put a headcount number in the same sentence as the technology spend.
Two legal AI companies raised the same $550 million, $6.7 billion apart
Legora closed a $550 million Series E at $8.8 billion led by Atreides Management, with annual recurring revenue above $200 million, up from $100 million in April and against a $5.6 billion mark six months ago. Harvey raised the identical $550 million about a month earlier at $15.5 billion, and reported passing $200 million in ARR back in March. Same cheque, same revenue scale, nearly double the price, which tells you more about how legal AI is being underwritten than about either company.
Quick Hits
- Kill switches: Palantir’s EVP for the UK and Europe, Louis Mosley, told Reuters “There are no kill switches” on NATO’s Maven after Ukraine reported its Starshield terminals stopped working on fast-moving platforms, a fear concrete enough that Germany’s cyber command ruled out buying Maven in April and France still has not adopted it.
- Disclosure norms: OpenAI published a five-stage framework for AI-discovered vulnerabilities, running from maintainers and technical partners through early access for distributors and security vendors to government engagement, and said it expects “similar findings to increase sharply in the coming months.”
- Fair use: a California federal judge appeared open to Anthropic’s defense in Concord Music’s suit, saying AI-produced mash-up lyrics “might constitute fair use,” the first judicial signal on generative output since the Third Circuit ruled against training a competing tool on Westlaw headnotes while dodging the output question.
- Surveillance policy: DHS quietly revised its AI directive so the chief AI officer can now waive any requirement, including prohibited uses, with no independent review, no notice to Congress and no expiration, while the chief privacy officer’s duty softened from ensuring AI “does not erode” privacy to ensuring it “complies.”
- Agent breaches: Gartner told its Orlando symposium that about 25% of enterprise breaches could trace to AI agent misuse by 2028, and separately that global IT spend will hit $7.35 trillion in 2027 as memory prices, already more than doubled in a year, keep climbing.
- Self-healing tickets: BT told ServiceNow’s London forum that about half its non-customer-impacting tickets now resolve themselves through Dynatrace and ServiceNow, roughly 30% of all tickets, while deliberately keeping humans in the loop on national-security and air-traffic-control systems.
- Agent credentials: 1Password passed $500 million in annual recurring revenue and shipped 1Password for Agents, crediting enterprise coding assistants and agents for the growth.
- Email agents: Carly gives an agent its own email address and can send or hold a draft for approval, with workflows that start from an incoming message instead of waiting to be asked.
- Lab agents: OpenAI, PerturbAI and Scripps ran thousands of GPT-Rosalind agents over a whole-brain CRISPR atlas in 32 minutes, work the team estimates would take months to a year by hand, though OpenAI is careful that the output is leads to test rather than results.
- Diffusion models: Inception says Mercury 3 hits 1,068 tokens per second against roughly 240 for Claude Haiku 5.5 and handles a million tokens of context, all of it measured by Inception with no independent check and no open weights.
- Robots and robotaxis: Tesla started Optimus production in California as net income fell 43% to $787 million, still claiming 20,000 units a week by end of 2027, and said it will begin selling Cybercabs this year even though unsupervised FSD for existing owners slipped to around Q2 2027.
- Data efficiency: year-old lab Flapping Airplanes raised $1 billion at a $6 billion valuation co-led by Index and Lux, quadrupling its January mark with no product on sale, to build models that need far less training data.
- Military AI: DeepMind research engineer Sofia Liguori resigned over the Pentagon and Israeli military contracts, pointing at the classified Pentagon deal Google announced in April and at Project Nimbus, and saying “AI for targeting is very dangerous; it creates a system where it’s easier to escalate the brutality of war,” though the Hacker News thread’s dominant objection was that a couple of resignations out of a workforce Alphabet’s size is not a movement.
- Terminal world models: Simon Edwardsson fine-tuned a 0.5B Qwen coder into a model that pretends to be a terminal with no shell and no filesystem, predicting how the character grid changes on every keypress, well enough to run vim and tmux.
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
