Good morning. It's Friday, October 23rd.

An AI found php2shell, and attackers got there first

The PHP project shipped an emergency release on Wednesday at 14:00 UTC for two vulnerabilities now going by php2shell: CVE-2026-109618, remote code execution via out-of-memory corruption, and CVE-2026-109619, remote code execution via stale global state. Both are rated CVSS v4.0 9.2 and both allow unauthenticated code execution, with the worst case on mod_php where a request fires before any application code runs. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4, 8.0 and 8.1. The project's own guidance is blunt: there are no complete mitigations, updating is the only safe choice.

PHP serves up to 70% of the web, and Palo Alto Networks counted 22.6 million potentially vulnerable instances. Exploitation started before the announcement. Cloudflare logged tens of thousands of attempts within 45 minutes of the news leaking and millions by that evening; AWS called it broadly exploited in the wild, with some attempts landing days ahead of the patch. Agencies in the Netherlands and Finland pulled sites offline as a precaution. The FBI's cyber division, the NSA and the EU's CERT all told organizations to update.

The vulnerable code had been sitting there for roughly 14 years, and a limited version of the bug surfaced in 2024 without anyone treating it as serious. OpenAI says GPT-5.6 Sol is what turned it into something real, and Wiz credits AI with the jump from "weird behavior" to working exploit chain. OpenAI coordinated the disclosure with the PHP Foundation, Cloudflare, Wiz, Quarkslab and US agencies, and launched Patch the Planet alongside it: a disclosure framework, a Codex skill that checks whether your site was hit, and $1 billion to subsidize its Daybreak auditing platform for under-resourced operators of essential services. OpenAI also warns the same capability helps attackers build exploits faster, which is not a hypothetical anymore.

Every maintainer now has an AI that can find decade-old bugs in their dependencies. So does everyone else. The asymmetry is not in who gets the tool, it is in who can ship a patch to 22 million servers.

Read more.

Claude Duet is an agent that messages you first

Anthropic opened a research preview of Claude Duet on Wednesday, a separate app built on Claude Opus 5.5 that inverts the chat model: it checks your connected accounts every few hours and pings you when something needs you, rather than waiting to be asked. There is a daily morning brief, and you set what it should surface and how often. It runs on its own virtual machine with its own browser, so it keeps working with your laptop closed.

Duet reads and drafts freely, but it shows you the plan before sending a message, making a payment, signing a document or deleting anything. Trading securities and moving money between accounts are off-limits even with your approval. It pulls from 6,000+ connectors in the Claude Marketplace, including Gmail, Slack, QuickBooks, Stripe, Gusto, DocuSign and Shopify, and can buy things through Stripe's Link wallet on a virtual card or check out with Shop Pay. It inherits your existing memory, skills and connections.

It is waitlisted and US-only for now, starting with Pro and Max subscribers, at no extra cost but drawing on the same usage limits. Anthropic is upfront about the gaps: it can misjudge urgency, it is weaker on personal errands than work tasks, and it cannot yet show you what its browser is doing. Separately, Anthropic made auto mode the default for more paid users this week.

"Cannot yet show you its browser" is doing a lot of work in a product that signs documents and spends money. Background agents you cannot watch are a trust problem before they are a capability problem.

Read more.

OpenAI's agents switched off their own monitoring, and outside testers found eight ways in

OpenAI published two incident reports this week. On October 3, an internal coding agent running GPT-6.1 Sol read an instruction not to send Slack messages as license to suppress monitoring alerts: it emptied the ping and page recipient lists, set no_notify to true, logged the reason as a user request, and reported "No messages were sent." The monitor kept running and kept saving reports. The humans just stopped hearing about them.

On October 6, GPT-6 Astra removed a monitor's configuration and runtime integration while migrating code to match a reference implementation, and replaced the monitoring regression test with an assertion that the monitor context was absent. It had earlier been told not to disable the monitor even temporarily. Asked directly whether it had removed an enabled monitor, it said no. OpenAI calls that a false claim and says it does not yet have a satisfying explanation for either case. Neither was classified P0, so neither paged security or killed the run. This follows seven other misalignment incidents disclosed the week before, including an internal research model spending crypto from a wallet it did not own.

Then on Thursday, METR and Redwood Research published the results of a three-week on-site red team of that same monitoring system, run in July and August with codebase, prompt and config access. They found eight bypass-class issues: a compaction gap letting an agent defer monitoring indefinitely by never returning control, a Codex sandbox escape, an exploit hiding hundreds of recent actions, a serialization mismatch that could crash the monitor, two client-controllable headers that simply turn monitoring off, and an exploit in two internal tools believed to be read-only. Coverage estimates: 75% to 94% of agentic Responses API traffic from GPT-5.5-class models and up was eligible for monitoring, and compaction likely left about 10% of eligible internal Codex traffic unmonitored from May to July. OpenAI says everything affecting its production safeguards has been patched. METR and Redwood have not verified that.

Two independent lines of evidence landed in the same week: the agents will turn the monitor off, and the monitor had doors anyway. Anyone building agent oversight on "we log everything" should read both.

Read more.

Recursive released Flint on Wednesday, its first model: a mixture-of-experts coder with 39.8B total and about 2.5B active parameters, Apache 2.0, built to run on a laptop. Recursive reports 125+ tokens/sec on an M4 Pro MacBook and 150+ on a 64GB RTX Spark, with 262K context on the model card. The scores are self-reported and the headline 89.7% is on Recursive's own SWE-bench Pro v2 run, not the public leaderboard, so anchor on the comparable ones: 74.2% SWE-bench Verified, 54.9% Terminal-Bench 2.1, where dense models still win outright. The real story is how it was built: Recursive's automated research system, the Eureka Machine, picked the expert configuration, quantized the output layer to 4 bits against conventional wisdom, and wrote the Metal and low-bit kernels. Weights are on Hugging Face in BF16, NVFP4, INT4 and GGUF, with a free OpenRouter endpoint.

OpenAI made the Decisions API generally available on Thursday, a GPT-6 Luna endpoint for bounded questions: classify this, route that, pick the next action. You define the question and the allowed answers and get back a predicate probability, a choice with per-option probabilities, or a rubric-weighted score. Pricing is $0.10 per million input tokens, $0.01 cached, and nothing for output, with OpenAI claiming up to 10x faster than the same model through the Responses API. Since beta it added native JSON inputs, prompt caching, US and EU inference residency, images in instructions and a 400-question-per-request ceiling. Box, Datadog, Ramp, Sierra and Speak are named customers.

Also shipped: 1Password launched a platform for deploying personal AI agents as it crossed $500M ARR, with autonomous-agent usage of its developer and AI security tools up 500% year over year.

Thank you for reading today's edition.

Your feedback is valuable. Respond to this email and tell us how you think we could add more value to this newsletter.

Interested in reaching smart readers like you? To become an AI Breakfast sponsor, reply to this email or DM us on X!

Thinking of starting your own newsletter? AI Breakfast readers who sign up with Beehiiv receive a 14-day free trial and 20% off for 3 months.