Sunday, 25 October 2026
Seven Security Experts Tell Reuters AI-Found Bugs Will Bring More Outages Like the PHP Scare
Seven Security Experts Tell Reuters AI-Found Bugs Will Bring More Outages Like the PHP Scare
On Thursday this site covered the two critical PHP flaws that AI tools helped find. What came next is the story: government websites in Europe and elsewhere went dark, some because operators rushed to patch, others because they simply switched their sites off until they could. On Thursday seven security professionals told Reuters this is the new normal. AI models now hunt for bugs around the clock and can turn one into a working exploit in hours, work that used to take weeks or months. VulnCheck says the number of flaws found has doubled in a year, partly thanks to AI-assisted research. The same week brought holes in Node.js and Plex and breaches at the AI gateway LiteLLM and the developer platform Railway. “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” said Cloudflare CEO Matthew Prince, who says he knows of more severe flaws in other critical software and has anecdotal evidence of PHP compromises. Not everyone is alarmed: curl’s lead developer Daniel Stenberg says AI-found bugs tend to be exotic and hard to exploit, and ArmorCode’s Ramy Rahman notes that “more disclosed vulnerabilities do not automatically mean more successful attacks.” Prince’s own verdict is that it ends well — “we’re going to get a lot of this stuff cleaned up.” The robots found the holes in a week. The cleaning crew is still the same size.
Google Left Gemini 4 Argon Alone With Its Agent Code for 11 Hours. Two of Six Changes Survived
Google’s engineers gave Gemini 4 Argon an overnight job: make the Python version of the company’s Agent Development Kit faster without breaking it. ADK is about 205,000 lines in nearly 800 files with almost 17,000 unit tests, and the agent ran unattended for 11 hours, read the team’s written guidelines, measured baselines, reviewed its own work and ran all 16,892 open-source tests. It proposed six optimizations. Code review kept two — filtering session history before copying it, and loading heavy packages only when needed — which cut session-preparation overhead by about 40% in long sessions and made importing the kit 21% faster; a 158-turn tool-calling run went from 65.6 to 56.1 seconds. The other four were rejected over reliability, maintainability or unproven gains, and one earlier attempt passed every public test but failed 25 of Google’s internal ones. The authors’ summary: “the agent explores, the maintainer subtracts.” InfoQ, writing it up on Saturday, adds the caveat: one codebase, one run. The overnight shift wrote the code. The day shift’s job is now mostly saying no.
Source: InfoQ, October 24, 2026
Anthropic’s Leaked IPO Draft: $16.3 Billion in Revenue and an $80.7 Billion Loss in Six Months
The Wall Street Journal has seen a draft of Anthropic’s S-1, the prospectus a company must publish before listing its shares, and on Wednesday reported what is in it. Revenue in the first half of 2026 was $16.3 billion, up from $1.1 billion a year earlier; full-year 2025 revenue was $4.6 billion. The net loss for the half-year was $80.7 billion, but about $72 billion of that is a non-cash accounting charge on financial instruments Anthropic sold to raise money, not cash spent. What was spent: nearly $9 billion on compute and infrastructure in six months, more than the $7.3 billion of all of 2025. Ahead lie cloud deals with Google ($111 billion), Amazon Web Services ($110 billion) and Microsoft ($31 billion), and compute commitments that could reach $750 billion. Anthropic confidentially submitted the draft on June 1 and has not commented on the leak; a public filing was expected as soon as Friday, but as of Sunday morning Tbilisi time none had appeared on the SEC’s EDGAR system. Sixteen billion dollars of revenue sounds enormous — until you see the size of the bill it came with.
Source: Fortune, October 21, 2026