Welcome to Eye on AI. Emily Forlini here, filling in for Beatrice Nolan. In today’s issue:
- Researchers discover a security flaw affecting 70% of the web
- Anthropic could file for IPO as soon as tomorrow
- Anthropic unveils Duet, its rival to OpenAI’s Dots and Meta’s Muse
- AI-driven layoffs at Barclay’s
I’ve been covering the growing number of AI-powered hacks for months now, going back to when OpenAI’s models autonomously attacked Hugging Face in July. Ever since then there’s been a steady drumbeat of incidents, and this month the tempo of alarming cyber news picked up considerably.
There have been more than 20 cybersecurity incidents in October, many just this week. The internet may officially be entering a new era, one in which sites are inherently less safe than they used to be. Cybersecurity paranoia is becoming table stakes for anyone who aims to conduct business online. Some are saying that the new “moat” for businesses is becoming how well they can protect their customers and IP from from AI-powered cyberattacks—not necessarily what that IP or customer base actually is.
Security professionals have long been warning that increasingly powerful AI tools would empower bad actors to exploit bugs in code. This week, experts told me, those warnings are now coming true. AI models have become noticeably more powerful at cyber tasks in recent months. Specifically, they’re better at processing large amounts of code, and acting autonomously. Hackers are having greater success setting off AI agents on evil missions. Sometimes, many AIs work together in groups known as agent swarms. These swarms move quicker than a human could keep up with.
So what’s an organization to do in the face of these threats? The only answer is to fight back with AI, meaning to proactively “hack” your own code, finding bugs before bad actors do and then patching them before AI-armed hackers can strike. That’s exactly what happened this week in incident that has already become the poster child for the coming wave of AI-powered attacks. The incident involved a legacy programming language called PHP.
The PHP flaw heard ’round the world
In August, multiple research teams at different organizations, all of them using AI models to help them hunt for security flaws, found two vulnerabilities in PHP, which an estimated 70% of the web runs on. Those two bugs, as well as the method for exploiting them, are now collectively named “php2shell.” OpenAI’s GPT-5.6 Sol model seems to have played a key role in this discovery, although other models, including Google’s Gemini 4 Argon, seem also to have played a part.
The researchers treated the discovery as an emergency, but the public didn’t find out about it until this week, when on Oct. 20 the PHP foundation announced it would be issuing a critical patch within the next 24 hours. The following day, a coalition of companies—including OpenAI, Wiz, Calif, and more—that had been privately working on a fix formally disclosed it. For the full story on who first discovered the bug, and how the companies worked together over the past two months, check out the story I wrote on this earlier this week.
This would be a purely good news story about a potential crisis successfully averted except for a few inconvenient facts. One is that news of the vulnerabilities and how to exploit them seem to have leaked in the days leading up to PHP’s announcement. According to Amazon Web Services, hackers started exploiting php2shell on Oct. 17, prior to the public disclosure. It’s possible they knew about the bug, which several organizations, including Amazon, had been notified about in advance. They had all agreed to a specific time—14:00 UTC on Oct. 21—when they could post about it as to not tip off the hackers early.
The other problem was the day-long window between PHP announcing that it was about to issue a patch and when it actually issued the patch, combined with the time lag that it naturally takes many companies to update their systems after the patch was issued. After the public disclosure of the exploit, the floodgates opened, and as of this writing there have been “millions” of attempts to exploit the bugs, while websites around the world built on flawed PHP code scramble to implement the patch. That work is still going on now. Luckily, the service most affected by the bug, WordPress, reports no issues. (Separately, Fortune published a great story this week on a failed coup of WordPress’s founder that’s worth a read.) Still, many governments and some private entities decided to take some web services offline to protect them from potential attacks while waiting for the patch to be implemented. This did save those sites from damage, but it also deprived people of the ability to use those services.
Turning hacks into cash
For organizations selling defensive AI cybersecurity tools, this is all very good news. That includes OpenAI. The company has been building out its Daybreak program, which is an application-only initiative that grants organizations access to its most sophisticated tools to help defend against sophisticated, AI-powered attacks.
The program is growing rapidly. Two weeks ago, OpenAI updated the Daybreak website with new numbers. The number of software flaws its participants have found swelled from 858 to 1,885. The number of patches produced went from 263 to 661. The more companies and cybersecurity professionals enroll, the more people are using OpenAI’s tools to proactively find and patch bugs in their code.
The PHP issue has raised further awareness of this program. OpenAI cofounder and president Greg Brockman gave it a boost too with an X post about the PHP exploit and OpenAI’s role in discovering it—a rare, lengthy post he has now pinned to the top of his profile. Brockman also hired a new chief revenue officer over the summer with a cybersecurity background, and tasked him with building out a sales team that can pitch its defensive software to companies.
OpenAI is also planning to debut a new cybersecurity-focused model this fall, as well as a first-of-its kind tool to help businesses deploy it more easily across their infrastructure. The company seems to have made a proactive bet on AI-powered cybersecurity tools being a burgeoning source of revenue, and that prediction is coming true. And they’re far from the only ones in this business; Anthropic has a similar program for cybersecurity professionals at vetted organizations called Project Glasswing, and multiple other SaaS providers offer AI-powered cyber defense tools.
They could be looking at some serious cash if the trend continues—and as long as the hackers don’t get to them first.
With that, here’s more AI news.
Emily Forlini
emily.forlini@fortune.com
@emilyforlini
FORTUNE ON AI
AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack—by Emily Forlini
Exclusive: AI code-testing startup Blacksmith hits $1 billion valuation as AI-written code surges—by Beatrice Nolan
Anthropic adds Harvard astrophysicist to the trust that controls its board—by Jeremy Kahn
Powerful new AI models are fueling a growing wave of cyberattacks, experts say—by Emily Forlini
AI IN THE NEWS
Anthropic could make its IPO prospectus public as soon as tomorrow. The public may finally get answers to many outstanding questions about Anthropic’s business and its finances when the company makes public the prospectus for its planned IPO, a move that could come as soon as tomorrow, according to three people familiar the company’s plans who spoke to Yahoo! Finance. Anthropic’s public stock offering could be the largest in history, valuing the Claude maker at more than $2 trillion.
Anthropic unveils its Duet personal agent. It’s the company’s answer to personal assistant AI agents such as Instinct, Meta’s Muse, and OpenAI’s Dots, but it’s only available now as a preview. Read more here from Engadget.
Microsoft discloses ‘hundreds’ of autonomous AI-powered hack by China state-aligned actor. The hacking group, known as Storm-0940, used an open-source AI platform called Artex, developed in China. That’s the same technology behind a hack of South Korean banks earlier this month. Read more here on the Microsoft blog.
Barclays to cut 5,000 jobs in AI-driven push to lower costs. The layoffs will affect 5% of the company’s workforce, and come after reporting a 12% increase in quarterly profit, falling short of analyst forecasts. Is AI the savior to help the company do more with fewer employees? Read more here in the New York Times.
EYE ON AI NUMBERS
10%
That’s how much of the internal traffic to OpenAI’s Codex coding tool went unmonitored for months this spring due to gaps in OpenAI’s internal safety and monitoring procedures, according to AI safety firms Redwood Research and METR. The firms were embedded at OpenAI for three weeks from July 21 to Aug. 11, during which they performed an independent audit of OpenAI’s security posture. They found that from May to July OpenAI’s Codex agent traffic was unmonitored, creating a “coverage gap that agents could have exploited to misbehave without being caught.” These are the same months leading up to and during the Hugging Face cyber incident, although the report does not say the lack of monitoring played a role in that case. METR and Redwood also found numerous other gaps in OpenAI’s monitoring systems.
AI CALENDAR
Nov. 9-12: Web Summit, Lisbon, Portugal.
Nov. 16-17: Fortune 500 Innovation Forum, Detroit. Apply here to attend.
Nov. 18-19: Slush, Helsinki, Finland.
Dec. 6-12: Neural Information Processing Systems (Neurips) conference. Sydney, Australia.
Dec. 7-8: Fortune Brainstorm AI, San Francisco. Apply here to attend.