Attackers probed an Amazon-flagged PHP flaw days before disclosure, Anthropic and Meta moved on products and funding, and DeepSeek reportedly raised $15B despite US restrictions.
-
Amazon says hackers tried PHP2Shell flaw four days before disclosure
- Amazon said it identified an attempt by hackers to exploit the bug four days before public disclosure.
- The NSA and UK authorities warned that the two vulnerabilities left websites worldwide critically exposed.
- The NSA told organizations using PHP to update immediately or take their systems offline.
- Researchers at Calif and Wiz found the flaws with help from OpenAI and Google models after they went undetected for more than a decade.
Why it matters. The case shows AI tools can find decades-old flaws in widely used software, and OpenAI said the same capabilities can help attackers build exploits. For developers, PHP 8.1 and older versions are no longer supported, and the recommended step is to update to the current version, 8.5.12.
-
Anthropic launches Claude Duet, an agent app for professionals
- Claude Duet is a new app from Anthropic aimed at professionals and small businesses.
- Duet can build daily briefings, create dashboards, and suggest actions based on a user's data.
- It can complete tasks in its own virtual machine in the background and return when it needs approval.
- It is built on Claude Opus 5.5 and is available on iOS, Android, and Claude.ai for Pro and Max customers in research preview.
Why it matters. Duet is another step toward agents that work on a user's behalf instead of only answering questions. Anthropic says sensitive steps such as payments need user approval, and the agent declines requests for credit card numbers and government identification by default. Rivals such as Meta Muse and OpenAI Dots are also targeting business use cases.
-
DeepSeek reportedly raises $15B days after US restrictions
- Two days after the U.S. ordered federal civilian agencies to remove DeepSeek's AI technology over security concerns, the Chinese AI lab reportedly raised about $15 billion.
- Bloomberg reported that potential investors include CATL and Tencent, among others.
- The round follows a June investment of more than $7 billion at a $50 billion valuation.
- DeepSeek may pursue an IPO in China as early as next year.
Why it matters. The report shows investors continuing to put large sums into AI labs in China despite U.S. restrictions. For developers, DeepSeek's plans to expand spending on infrastructure and open models point to more competition among open models.
-
Recursive launches Flint, a free coding model it says AI helped build
- Recursive released Flint, its first model, on Wednesday as a free coding model that runs on a laptop.
- The company says its automated research system, the Eureka Machine, helped with nearly every step of Flint's development.
- Flint has 40 billion parameters but uses only 2.5 billion at a time, and it is free to download on Hugging Face under the Apache 2.0 license.
- In Recursive's tests, Flint generated about 131 tokens per second on a MacBook Pro with Apple's M4 Pro chip.
Why it matters. The launch is an early public test of recursive self-improvement, the idea that AI can build better AI. For developers, it offers a small model that runs offline and keeps code private, though the company says it needs more guidance than large paid coding assistants.
-
Thousands of AI agents uncover new leads in biological data
- OpenAI, PerturbAI, and Scripps Research used distributed AI agents to uncover promising research leads.
- The work used data from millions of brain cells.
- The article describes the effort as using thousands of AI agents.
Why it matters. The work shows AI agents running at scale on large biological datasets. For developers, it is a concrete case of distributed agents applied to research data. The article does not report clinical results, so the practical value of the leads is still open.
-
Evhub proposes monitorability red lines for AI labs
- The post categorizes four types of monitorability and discusses how trustedness affects them.
- It notes that a monitor using the same model as the policy could in principle get a perfect score, so trusted monitors are needed.
- It proposes evaluating the ratio of unmonitorability to capabilities, which it calls the monitorability externality, and rejecting model changes that push it too high.
- It proposes Control and Training Monitorability red lines, with Auditing Monitorability implicit in how monitors are judged trusted.
Why it matters. Monitoring is one of the tools proposed for overseeing advanced models, so red lines on it would limit how labs build and change models. The post argues that absolute red lines alone do not constrain actions today, so it pairs them with limits on changes that degrade monitorability. For developers, it offers a concrete way to think about how oversight holds up as capabilities grow.
-
Meta creates new non-voting share class to fund AI push
- Meta says it is issuing a new class of non-voting shares to fund its AI initiatives.
- The company announced the shares in its third-quarter earnings report, released on Wednesday.
- Meta also expects capital expenditures between $135 billion and $145 billion this year, up from its previous estimate of $130 billion to $145 billion.
- Meta launched its AI agent, Muse, in September, and the app hit 10 million downloads in the US this week.
Why it matters. The move shows how much capital large AI builders now need for data centers, talent and models. It also signals that funding for AI is moving into new financing structures. Developers should watch how Muse's privacy problems are handled as agents get more access to personal data.
-
Claude's scorpion antivenom experiment yields binders, not a drug
- Citrini Research teamed up with Anthropic to see whether an unreleased version of Claude could design scorpion antivenom.
- Anthropic said Claude generated nearly 320,000 candidates, narrowed to 211 designs.
- Two outside labs tested the designs, and 17 proteins bound to four of the five targeted scorpion toxins.
- Citrini admitted the proteins were not tested for neutralizing the toxin, and outside experts called the results far from a medicine.
Why it matters. The story shows how far AI-driven discovery is from a usable drug, even when the early steps work. Experts said binding is relatively easy, while translating proteins into safe medicines remains the hard part. Developers should note that the most novel part, according to researchers, was the autonomous process rather than the biology.
