Hey %%first_name%%,

Welcome to what cybersecurity experts are calling “Black October” - after a series of critical vulnerabilities that allow remote execution were found in PHP and Node.js, several companies were hacked, and a new supply chain attack on the very popular LiteLLM library was acknowledged.

The internet is freaking out, and we’ve tried to make sense of it all, with a security expert Josh Long on the show.

Also this week, Anthropic stepped into the personal agent category with Claude Duet, their direct competitor to Dots from OpenAI, Muse from Meta etc’. Duet is proactive and always on, and can do work while you’re asleep! I got access this morning so this isn’t the full review yet.

Also DeepSeek is back with a new model and their inference engine!

Let’s dive in:

ThursdAI - Highest signal weekly AI news show is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Claude Duet - a personal agent powered by Opus 5.5 and doesn’t wait for you (X, Product, Blog)

To me this is the most exciting announcement of the week (which otherwise was full of doom and gloom). Anthropic finally stepped into the personal agent category! Shipping Claude Duet, as a separate mobile app, and its own online UI (claude.ai/messages) which is what I was missing from OpenAI’s Dots!

Duet is built around Opus 5.5, brings over your existing memory, skills and connected apps, and reaches into 6,000+ connectors and plugins on their platform. Every few hours it checks your accounts, surfaces what needs you, and does the task from its own cloud computer, laptop closed.

The rest is pretty much the same, similar UI, similar features to others, just with Claude taste and intelligence. It can somehow interact with Claude Code but not fully, so it can’t be used as a chief of staff. This seems like a weak link given just how much folks are using Claude Code.

Claude Duet is also not personal at all, I didn’t find a way to rename it or make it “mine”, it doesn’t seem to do any phone calls. So for now, it’s a great start, but definitely not replacing Muse for me.

Hot take: Anthropic is following in this category, not leading. OpenClaw and Hermes worked best with Anthropic models, then Anthropic cut off subscription access for them, and now we finally see why. Every lab has a personal agent now: Dots, Muse (still leading for me), Grok Bot, and Google’s Spark, which most people don’t even know exists. Nisten says Dots “feels like that government employee that tries to avoid all responsibility”, while Muse is “so energetic”. LDJ finds Dots a net positive.

My big realization: switching personal agents is WAY harder than switching coding harnesses. Once your assistant knows everything about you, moving takes a lot of effort for the human. If you only copy over the memories/context, then you have two/three AI assistants doing the same work, sending you the same notifications and all updating you about the same emails.

Black October: the densest and scariest security week I can remember

Some folks are calling this month Black October, and it’s one of the worst I can remember. Some bugs were found by AI, some attacks are run by AI (Microsoft says a China state-aligned group used an agentic pentest framework called ARTEX against hundreds of organizations), and some attackers are just going after your AI keys. Security expert Josh Long joined to keep us sane, with an attempt of positivity though it wasn’t easy!

PHP2Shell - AI helped find holes in the language that runs 70% of websites (Wiz, OpenAI, Blog, Calif, CISA, Checker)

This was one of the hugest things that shook the industry this week!

PHP runs an estimated 70% of websites, and two bugs in the language engine itself let an attacker send one request, no login, and potentially take over the server with code execution ability. CVSS 9.2, every release back to 5.4. It is really important that if you are running anything on a PHP server, that you patch it right away. Ask your agents to do a security audit.

This vulnerability was present in the PHP code for 14 years! Calif found the first bug in an audit funded through OpenAI’s Patch the Planet initiative. Josh says several groups finding the same bugs independently is rare, his advice was refreshingly calm: if you run a PHP server, you should have patched yesterday, no excuses. Cloudflare invented a new form of WAF to block it for all websites that are protected by Cloudflare and the big cloud companies patched right away, so regular folks browsing the web can go about their daily business.

Still, a lot of websites that are run on PHP and aren’t able to patch, their IT guy quit, or they lost the keys to their servers, and your information can be at risk of getting stolen. Personal security actions like locking down your credit (if you’re in US), rotating passwords, having a password manager is always a good idea.

OpenAI Daybreak - the defenders got the good models (X, Infosecurity)

Back in August, post the HuggingFace hack, Greg Brockman penned “the defenders window“, where he outlined that Defenders need access to the best models, with lower safeguards to get ahead of the attackers. It seems that this defenders window was starting to close this week, given the hacks that happened in addition to the PHP2Shell vulnerability disclosure, which for the record, wasn’t a hack!

OpenAI’s Daybreak blue gave vetted researchers GPT-5.6 Sol with loosened safeguards (and GPT-5.6-Cyber on the Red tier), and Hacktron’s s1r1us credits it for a run of finds: a HEIF heist, a KVM escape, PHP2Shell, GitLab RCEs, a full Chrome chain and a WordPress RCE. Greg Brockman calls this the Defender’s Window, and it does feel like it’s closing.

Railway and OpenCode: someone is always hunting your AI keys (Railway, OpenCode)

OpenCode got hacked about a week ago, and now Railway too, and what the attackers seem to be after is your LLM API keys. The main reason is, API keys can be immediately sold on the black market and used for distillation. They are immediately and immensely valuable.

Think about it. Your personal data is probably on the dark web already, I’m not sure how much your SSN is even worth right now. But an OpenAI or Anthropic key without a limit on it is basically direct access to your credit card, and there are people buying those keys on the black market for distillation. If you had keys on either service, invalidate, rotate them and make sure to have separate keys for each service despite how much pain in the A it is. Also always add a limit!

If only there was a more secure way to make machines talk to other machines!? Turns out, there is, it’s called OIDC, it just wasn’t implemented yet by anyone besides the big companies. It’s more complex than just minting a simple API key and pasting it into a file, but it’s definitely the right way to go!

eMudhra - root certificates with a private key of... 4? (X, Cloudflare)

The other big one this week has nothing to do with AI, it’s just plain human negligence. eMudhra is one of the certificate authorities your browser trusts to sign HTTPS certificates, and it turns out some of their root certificates were created with a trivial private key (Cloudflare’s Matthew Prince says it was literally the number 4!). Anyone who figures that out can mint a “valid” certificate for any website, and your browser would happily trust it.

Josh (who wrote about DigiNotar back in 2011, a very similar mess) walked us through what this means in practice, and it’s less scary than the timeline makes it sound. To abuse this, an attacker has to sit in the middle of your connection, think sketchy coffee shop Wi-Fi, and only then can they pretend to be Google.com and read traffic you thought was encrypted. Chrome, Brave, Edge and Firefox have already removed eMudhra’s roots, and Safari is lagging behind because Apple takes its time with patches. So update your browser and your OS, and you’re good.

Nisten has a theory that the key was changed by hand during the signing ceremony, because “if it was an LLM, it would have at least done something better” 😂

LiteLLM 1.107.0 - a supply chain attack that steals your keys (Wiz, StepSecurity)

And as if that wasn’t enough, LiteLLM, the very popular Python library a lot of us use to route between LLM providers, shipped a poisoned 1.107.0 release with a credential stealer that grabs your cloud, SSH and LLM keys. It was live for about an hour and forty minutes. If you installed it, go back to 1.106.2 and rotate everything. Josh pointed out the irony: the folks who followed best practice and updated right away are exactly the ones who got hit.

How to protect yourself (and your agents) this week (Eito’s checklist)

“Update everything immediately” is not simple advice anymore, so here’s the distinction we landed on during the show. Your browser, OS and phone: hit that update notification right away. PHP and Node on your servers: patch now. But package managers like pip, uv and npm are where supply chain attacks live, so don’t install a package version that’s less than 24 hours old, which gives maintainers time to pull a poisoned release like the LiteLLM one.

For your API keys: rotate them, know which agent has which key, put caps and email alerts on all of them, and please, use a password manager. Wolfram put it well, treat API keys like a credit card, except worse, because your card at least has a CVC and 2FA. Nisten’s setup is worth stealing: every morning at 6am an Opus prompt checks every pip, npm and Linux package on his machines against the latest security news and sends him a report.

And if you’re freaking out on X, remember the algorithm loves fear and will keep feeding it to you. The big companies patched, the sky isn’t falling, so go touch some grass and then do your security homework.

1Password for Agents (X, Blog)

Some good news to end on, breaking during the show (thanks Peter!): 1Password launched a platform for agents. When your agent hits a sign-in form, it requests a credential, you approve, and 1Password fills it in directly, so the agent logs in without ever seeing your password. It’s basically Stripe Link for passwords, and since 1Password has been the most reliable tool in my life for 15 years, I joined the waitlist right away.

Big Companies & APIs

Anthropic commits 5% of its shares to a Public Benefit Fund (X, Blog)

Anthropic put 5% of its shares into a new Public Benefit Fund, and together with the founders pledging 80% of their equity and employee matching, they say roughly 20% of the company is now earmarked for the public good, ahead of what’s expected to be a huge IPO. (LDJ corrected me on the show, Anthropic has been a PBC since before ChatGPT existed, what’s new is this specific fund.) Dario also wrote a very long reply to Nathan Calvin’s critique, and the bit that stuck with me is that they held Mythos-class models from February until June, when the cyber safeguards were ready.

OpenAI - 12-hour prompt caching, and a Codex cache that never expires (X, Tibo)

OpenAI shipped the most boring features this week, but maybe the most useful ones. 12-hour prompt caching is now in the API, pitched at always-on agents like Dots that reuse the same tools all day. The bigger piece came from Tibo on the Codex team: in Codex, the cache for logged-in users now never expires, so you can come back to a thread from last week and still hit it. In Claude Code, coming back to a long thread means paying for all those tokens from scratch. Storing all that can’t be cheap (LDJ’s theory: “Hey Astra, design a new SSD”).

Also, GPT-6 Astra Pro in ChatGPT now runs multiple agents on parts of your task in parallel. I’ve been pretty disappointed in Astra (it just stops all the time), but Astra Pro is basically many big models in a trench coat, so I’m curious.

Gemini 4 Argon, one week in (Logan, Paper)

Logan says Argon processed about 25 trillion tokens in its first 72 hours, and Sundar said Google is compute constrained. Google! The coolest Argon story this week (ok, Claude picked it as my favorite, let’s call things like they are 😂) is four Argon agents beating Minecraft from scratch in 27 hours with no human help, dying 605 times along the way... on easy mode.

Open Source AI

DeepSeek V4.1-Flash-1017 - better and cheaper, still MIT (X, HF)

The whale has resurfaced! DeepSeek shipped yet another checkpoint of V4.1 Flash (1017, what a mouthful), still MIT licensed. Terminal-Bench 4.0 jumps from 31.2 to 42.3 and the outputs got shorter, so it’s both better and cheaper to run. LDJ thinks it’s better than the previous checkpoint but not threatening the Fables and Astras (and he really wishes they’d just call it V4.2).

Where it absolutely crushes it though is cost per task. DeepSeek is alone in the top left of this chart, and you can only pull that off with a very, very good inference stack. Which brings me to...

DeepInfer - DeepSeek open sourced the engine it actually runs on (X, GitHub)

DeepSeek open sourced DeepInfer, the inference engine that serves V4.1 Flash in production, under Apache 2, running on both NVIDIA Blackwells and Huawei’s Ascend 950. Tim Dettmers (the QLoRA guy) says it’s on par with OpenAI’s production stack, and better than what Anthropic runs, at least at their user size.

Yam joined just in time (”Bro, they broke the internet”) and explained why this is a big deal: serving is every inference provider’s bread and butter, and the more users you serve on the same hardware, the more margin you keep, “you literally print money”. Our folks at CoreWeave are already comparing it with vLLM, and I expect prices to come down everywhere because of this.

Flint - a local coding model designed by the Eureka Machine (X, Blog, HF)

Western open source! Recursive (Richard Socher’s new lab) released Flint, a 39.8B MoE with only 2.5B active, Apache 2, built to run fast for coding on your Mac. Nisten ran agents on it all day and calls it underhyped: tiny, but extremely fast.

Tim Shi from Recursive joined us (first time on the pod!), and the most interesting part isn’t the model, it’s how they made it. Flint is the first demo of their Eureka Machine, a system of agents that propose, implement and validate ideas in a loop. They asked it for the best architecture for speed plus coding on a MacBook, and it came back with something way sparser than comparable models. My favorite detail: every human researcher will tell you never to quantize the LM head to 4 bits, the Eureka Machine tried it anyway, and it turned out to be a good idea. And they went from zero pre-training effort to a released model in under 4 months!

Prince Canuma, our MLX king, had day zero support and now ranks Flint in his top 3 local coding models, with up to 8 agents in parallel hitting nearly 500 tokens per second on an M5 Max. After this week’s security mess, an agent that never leaves your machine is starting to look like a feature.

Jensen closes GTC Berlin with Hermes Agent (X)

“The way you build an agent, is you ask an agent to build it for you” - Jensen Huang

GTC Berlin is full of red claws, but Jensen closed his keynote with Hermes Agent from Nous Research! He set up a custom Hermes in one prompt and had it train MicroDuck robots in simulation until four real ones walked around on stage. Fun fact: MicroDucks come from Pollen Robotics, which Hugging Face bought, and Hugging Face is now part of NVIDIA 😂

From the Forge, powered by CoreWeave (Forge)

After 3.5 years, This Week’s Buzz is retired, and our sponsor corner is now From the Forge, powered by CoreWeave (with a brand new intro made with MiniMax H3 Max and an ElevenLabs jingle, I need to get used to saying it!).

Wolfram was at our booth at GTC Berlin and showed us the new NVIDIA HGX Rubin NVL8 sitting right there on the desk, a $1.2M box, coming to CoreWeave this quarter with NVIDIA projecting 10x more tokens per megawatt than HGX B200. And Reflection’s Beam (501B, Apache 2) is running on CoreWeave Serverless Inference from day zero, after being trained with Weights & Biases inside Forge (”we knew Beam back when it was just a loss curve”). Forge is free to start, go check it out.

Vision & Video

Kling 4.0 - 30 seconds of 4K video in a single pass (X, Release notes)

We’re now in the era of 30 seconds of 4K video with stereo audio, in one pass. We played the demos live and the lip sync is genuinely great, though the rap one was very clearly AI generated. Peter says Kling 3 sits around 19th on Arena, so a strong Kling 4 adds another top tier competitor, and the race now is realism and speed.

On speed, Black Forest Labs and our friends at fal launched FLUX 3 Max (X), a 10-second clip in about 12 seconds, so not quite real time but close. And Wolfram is running MiniMax H3 locally on his 3090, which he calls “almost frontier, I would call it frontier”.

Wrapping up

There’s a reason it took the big labs 8 or 9 months after OpenClaw to ship their own personal agents, and after a week like this one, I get why they took their time. So, patch your PHP and Node, update your browser and OS, wait 24 hours on new packages, cap and rotate your API keys, and use a password manager. Huge thanks to Josh, Tim, Prince, Wolfram, LDJ, Nisten, Yam and Peter. Next week, my full Claude Duet review. See you next week!

TL;DR and show notes

* Hosts and Guests

* Alex Volkov - AI Evangelist, CoreWeave (@altryne)

* Co-hosts: @WolframRvnwlf, @ldjconfirmed, @nisten, @yampeleg, @petergostev

* Tim Shi - co-founder, Recursive (@Recursive_SI)

* Prince Canuma - Nativ, mlx-vlm (@Prince_Canuma)

* Josh Long - security expert (@theJoshMeister)

* Big CO LLMs + APIs

* Anthropic commits 5% of its shares to a Public Benefit Fund, ~20% of the company now earmarked for the public good (X, Blog)

* Dario Amodei answers Nathan Calvin’s critique (Dario, Calvin)

* Claude Duet: a proactive Opus 5.5 agent, research preview waitlist for US Pro and Max (X, Product, Blog)

* OpenAI 12-hour prompt caching; Codex and Work cache never expires (X, Tibo, Docs)

* GPT-6 Astra Pro runs parallel agents in ChatGPT (X)

* OpenAI models come to Google Cloud Model Garden, private preview (X, Blog)

* OpenAI acquires Orchestra Bio; free Rosalind plan for university labs (Blog, Blog)

* Aleksander Madry returns to OpenAI to work on safety and security (X)

* Gemini 4 Argon: ~25T tokens in 72 hours, four Argon agents beat Minecraft in 27 hours, now in Antigravity for Pro (X, X, Paper, Blog)

* Inception Mercury 3: diffusion LLM, 1,000+ tok/s, 1M context (vendor numbers) (X)

* Security week (Black October)

* PHP2Shell: two critical PHP engine RCEs (CVSS 9.2); upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (Wiz, OpenAI, Blog, Calif, CISA, Checker)

* eMudhra root TLS certificates had a trivial private key; update your browser and OS (X, Cloudflare)

* OpenAI Daybreak credited with a run of big finds, from PHP2Shell to a Chrome full chain (X, Infosecurity)

* Railway: attacker accessed customer environment variables, some decrypted; roll all keys (Blog, Status)

* OpenCode Console breach exposed stored provider keys for 1.4% of Console users (StepSecurity)

* LiteLLM 1.107.0 backdoored on PyPI and Docker with a credential stealer; pin 1.106.2 and rotate keys (Wiz, StepSecurity)

* Microsoft: Storm-0940 used the agentic AI pentest framework ARTEX against hundreds of orgs (X, Blog)

* Eito Miyamura’s practical security checklist (X)

* 1Password for Agents: agents use your logins without seeing your passwords (X, Blog)

* Open Source LLMs

* DeepSeek V4.1-Flash-1017 (MIT): Terminal-Bench 4.0 31.2 to 42.3; Search and Fetch APIs open to all (X, HF)

* DeepSeek open-sources DeepInfer, its production inference engine (Apache 2.0) (X, GitHub, Tim Dettmers)

* MiniMax M3.1 Flash is Space Bunny: $0.15 / $0.60 per 1M tokens, weights due Oct 23 (X)

* Recursive Flint: 39.8B total, 2.5B active local coding model (Apache 2.0) (X, Blog, HF, Nativ)

* vLLM Semantic Router Decision 3.0 (D3) decider models (HF)

* Agents & Tools

* Jensen closes GTC Berlin with Hermes Agent training HF’s Microduck in sim (X)

* NVIDIA OpenShell Reference Architecture: boundaries for agents (X)

* From the Forge, powered by CoreWeave

* Reflection’s Beam full weights on CoreWeave Serverless Inference; CoreWeave says Reflection used W&B in Forge during training (X, Blog)

* RL Rollouts: NVIDIA and You.com post-train Nemotron 3.5 Lightning, BrowseComp 37% to 45% (X)

* Physical AI Launchables: one-command robotics templates (X)

* NVIDIA HGX Rubin NVL8 comes to CoreWeave Cloud this quarter (X)

* CoreWeave Zero Trust AI Framework (X)

* NVIDIA DSX POD: pre-tested AI factories in as little as 14 days (X)

* Forge: free to start, 30-day Pro trial (Forge)

* Vision & Video

* Kling 4.0: up to 30s in one pass, 10 keyframes, 15 references, API rolling out (X, Release notes)

* FLUX 3 Max (BFL + fal): a 10-second clip in ~12 seconds (X, X, fal)

* MiniMax H3, open weights, running locally on a 3090 (HF)

* Odyssey puts a simulated FlyWire fruit fly brain inside the Odyssey-3 world model (X)

* AI Art & Diffusion

* Krea 3 Ultra: #4 on Arena multi-image edit, behind only OpenAI (X, Blog)

* Voice & Audio

* ElevenLabs Eleven Realtime: 0.57s to first audio, OpenAI Realtime-compatible API (X, Blog)

* Mistral Voxtral 3: transcription, TTS and a voice agent API (X, Blog)

* Underdog Bark 3.0: 163 MB open speech-to-text that ties NVIDIA Parakeet (CC-BY 4.0) (X, HF)

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit sub.thursdai.news/subscribe

ThursdAI - Oct 22 - AI finds all the vulnerabilities, Claude Duet, DeepSeek drops Infer & more AI news

ThursdAI - The top AI news from the past week

ThursdAI - Oct 22 - AI finds all the vulnerabilities, Claude Duet, DeepSeek drops Infer & more AI news