WIRED reported that the newly disclosed PHP vulnerabilities are collectively called PHP2Shell, and within hours of disclosure Cloudflare recorded millions of exploitation attempts, but the PHP Foundation said it has not yet seen a successful exploit. Researchers at security firm Calif, using frontier models from OpenAI's Patch the Planet project combined with PHP expertise, first discovered and constructed an exploit in early August, and researchers from OpenAI and Google's Wiz subsequently also independently discovered similar vulnerabilities using AI. Multiple researchers believe AI has not introduced entirely new attack methods, but has amplified the existing pace of vulnerability discovery and disclosure.
t yet seen a successful exploit. Researchers at security firm Calif, using frontier models from OpenAI's Patch the Planet project combined with PHP expertise, first discovered and constructed an exploit in early August, and researchers from OpenAI and Google's Wiz subsequently also independently discovered similar vulnerabilities using AI. Multiple researchers believe AI has not introduced entirely new attack methods, but has amplified the existing pace of vulnerability discovery and disclosure.
gihyo.jp reviews multiple releases and reports from late October, organizing AI-era defense challenges along two lines: vulnerability remediation implementation and permission management. Anthropic Deputy CISO Jason D. Clinton says that within about 18 months, high cyber capability will spread to small, cheap models, but fixes still need to be applied to running systems. The article cites OpenAI's discovery of Brotli's CVE-2026-111497 during testing in an isolated environment, and introduces remediation and credential control solutions such as AWS Continuum, Google Agent Compute Engine, and 1Password for Agents, as well as Microsoft's report on Storm-0940 using AI to automate attacks.
opic Deputy CISO Jason D. Clinton says that within about 18 months, high cyber capability will spread to small, cheap models, but fixes still need to be applied to running systems. The article cites OpenAI's discovery of Brotli's CVE-2026-111497 during testing in an isolated environment, and introduces remediation and credential control solutions such as AWS Continuum, Google Agent Compute Engine, and 1Password for Agents, as well as Microsoft's report on Storm-0940 using AI to automate attacks.
Meta launched its personal AI Agent Muse last month. It has an independent virtual computer and browser and can send emails, book travel, and shop on behalf of users. It reached about 2.8 million downloads within two weeks of launch, and at the October 21 earnings call it was announced that more than 10 million people had activated it. Less than two weeks after launch, Muse was blocked by Amazon from accessing its shopping site. Amazon said AI Agents should identify themselves and respect whether the service provider permits entry. The article argues that the two sides are fighting over who controls the subsequent search, comparison, decision-making, and payment after consumers form purchase intent, while Google keeps intent-to-execution within its own system through its own ecosystem such as Universal Cart.
had activated it. Less than two weeks after launch, Muse was blocked by Amazon from accessing its shopping site. Amazon said AI Agents should identify themselves and respect whether the service provider permits entry. The article argues that the two sides are fighting over who controls the subsequent search, comparison, decision-making, and payment after consumers form purchase intent, while Google keeps intent-to-execution within its own system through its own ecosystem such as Universal Cart.
Google CEO Pichai revealed in the "Sources" interview that Gemini 4 Argon processed about 25 trillion tokens in 72 hours of launch, 3 times that of Gemini 3.0 in the same period, and is still rate-limited due to compute constraints. He explained for the first time the reason for cutting Gemini 3.5 Pro: the team found a gap in the model on Agentic Coding, first used the Flash version to complete intensive iterations from 3.5 to 3.8 in about 3 months, while Argon pretraining had already been completed at that time, so they injected the accumulated gains into Argon post-training. He also mentioned that Google internally has entered the RSI stage of researchers and models collaborating, and said the next-generation Gemini 5.0 will be much stronger than Argon.
Google CEO Pichai revealed in the "Sources" interview that Gemini 4 Argon processed about 25 trillion tokens in 72 hours of launch, 3 times that of Gemini 3.0 in the same period, and is still rate-limited due to compute constraints. He explained for the first time the reason for cutting Gemini 3.5 Pro: the team found a gap in the model on Agentic Coding, first used the Flash version to complete intensive iterations from 3.5 to 3.8 in about 3 months, while Argon pretraining had already been compl
Alex Heath asked Google CEO Pichai why Gemini 3.5 Pro ultimately was not released. Pichai said that while training the 3.5 series, the team found gaps in agentic capabilities, especially in coding, and believed that iterating with the smaller, more efficient Flash would be faster, so they released 3.5, 3.6, 3.7, and 3.8 Flash in succession; by the time this set of capabilities could be applied to Pro, Argon pretraining had already been completed.
Rohan Paul, citing Sundar Pichai, said that compute capacity for 2027 is basically already gone. Pichai said that if customers come asking for 2027 compute capacity now, it will be very difficult, which is one of the reasons Google rented some short-term compute capacity last year to help customers. The full video was posted on Alex Kantrowitz's YouTube channel.