How much of the internet is held together by code nobody’s looked at in twenty years? This week we look at the AI-discovered PHP flaws that made governments pull websites offline in what’s being called Black October for cybersecurity, Anthropic’s S-1 and the first profitable quarter at a frontier lab, high-frequency traders spending billions on compute, and Claude Duet, an always-on agent built for work.
The trend:AI found two critical vulnerabilities in PHP, the programming language that 70% of websites run on, with the NSA telling anyone who couldn’t patch immediately to pull systems offline.
The details:Security startup Calif.io found the first flaw using GPT-5.6 Sol, and Google-owned Wiz found both independently using Sol and Gemini 4 Argon weeks later. OpenAI worked with the maintainers of PHP for two months on fixes, which Wiz researchers called “the most severe vulnerabilities ever discovered by AI, if not in all of software history.” At the same time various other cybersecurity issues surfaced, with Node.js, LiteLLM, GitLab and eMudhra all releasing patches to flaws or having embarrassing security issues, leading to the month’s “Black October” nickname.
Why it matters: The PHP flaws went undiscovered for decades until AI found them, which shows how vulnerable pre-AI code has now become. Anthropic’s deputy security chief said that things are going to get “a lot worse before they get better” and told security leaders to brace for a rough 18 months.
The details: Anthropic ($ANT) revenue grew 14x from a year earlier, hitting $16.3 billion in the first six months of 2026. Q2 alone turned a $974 million operating profit. The prospectus warns potential investors that the company could lose visibility into its own operations, with Claude writing over 90% of Anthropic’s code in September. It also warns of various other risks including a “catastrophic AI-related incident” that no insurer could cover, customer concentration, possible nationalization, and a potential struggle to secure increasingly expensive and scarce compute.
Why it matters: A profitable quarter shows that the business model can work. Now the question will be what AI labs are worth on the open market, and if they can make investors some money before ending humanity.
High-frequency trading firms like Jane Street and Hudson River Trading have historically fought for nanosecond-sized advantages when moving in and out of positions to make a profit. Now they’re fighting over compute as they look to secure access to the processing power behind AI. One exec estimates that the industry is spending 10-20x more on computing power than before ChatGPT launched, as machine learning now drives trading strategy, so an edge in compute becomes an edge in profits. Firms are also spending billions both on their own data centers (Hudson River has one inside a Norwegian mountain, cooled by fjord water) and on AI startups like Thinking Machines (backed by Jane Street). “If you find that advantage, then it doesn’t matter how expensive the infrastructure is,” says Positron CEO Mitesh Agrawal. “The return on investment becomes very, very clear.”
Anthropic is joining the AI assistant agent race with Claude Duet, a personal agent built for work that can check emails and calendars, draft replies and follow up on unfinished work. Much like its rival Muse, Duet has persistent memory and continues working toward goals while the user is away, but Anthropic says that Duet is built for work and is less capable at personal errands. While Anthropic has been working on this for months (Claude Tag was introduced back in June and can follow Slack conversations and check in on unresolved tasks) they’ve arrived late to a market of always-on AI agents, joining X’s Grok Bot, OpenAI’s Dots and Meta’s Muse. The launch of Duet may be defensive, aimed at stopping users handing off daily tasks to a rival’s assistant.
%201.svg)
