Hey %%first_name%%,
Welcome to what cybersecurity experts are calling “Black October” - after a series of critical vulnerabilities that allow remote execution were found in PHP and Node.js, several companies were hacked, and a new supply chain attack on the very popular LiteLLM library was acknowledged.
The internet is freaking out, and we’ve tried to make sense of it all, with a security expert Josh Long on the show.
Also this week, Anthropic stepped into the personal agent category with Claude Duet, their direct competitor to Dots from OpenAI, Muse from Meta etc’. Duet is proactive and always on, and can do work while you’re asleep! I got access this morning so this isn’t the full review yet.
Also DeepSeek is back with a new model and their inference engine!
Let’s dive in:
ThursdAI - Highest signal weekly AI news show is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.
Claude Duet - a personal agent powered by Opus 5.5 and doesn’t wait for you (X, Product, Blog)
To me this is the most exciting announcement of the week (which otherwise was full of doom and gloom). Anthropic finally stepped into the personal agent category! Shipping Claude Duet, as a separate mobile app, and its own online UI (claude.ai/messages) which is what I was missing from OpenAI’s Dots!
Duet is built around Opus 5.5, brings over your existing memory, skills and connected apps, and reaches into 6,000+ connectors and plugins on their platform. Every few hours it checks your accounts, surfaces what needs you, and does the task from its own cloud computer, laptop closed.
The rest is pretty much the same, similar UI, similar features to others, just with Claude taste and intelligence. It can somehow interact with Claude Code but not fully, so it can’t be used as a chief of staff. This seems like a weak link given just how much folks are using Claude Code.
Claude Duet is also not personal at all, I didn’t find a way to rename it or make it “mine”, it doesn’t seem to do any phone calls. So for now, it’s a great start, but definitely not replacing Muse for me.
Hot take: Anthropic is following in this category, not leading. OpenClaw and Hermes worked best with Anthropic models, then Anthropic cut off subscription access for them, and now we finally see why. Every lab has a personal agent now: Dots, Muse (still leading for me), Grok Bot, and Google’s Spark, which most people don’t even know exists. Nisten says Dots “feels like that government employee that tries to avoid all responsibility”, while Muse is “so energetic”. LDJ finds Dots a net positive.
My big realization: switching personal agents is WAY harder than switching coding harnesses. Once your assistant knows everything about you, moving takes a lot of effort for the human. If you only copy over the memories/context, then you have two/three AI assistants doing the same work, sending you the same notifications and all updating you about the same emails.
Black October: the densest and scariest security week I can remember
Some folks are calling this month Black October, and it’s one of the worst I can remember. Some bugs were found by AI, some attacks are run by AI (Microsoft says a China state-aligned group used an agentic pentest framework called ARTEX against hundreds of organizations), and some attackers are just going after your AI keys. Security expert Josh Long joined to keep us sane, with an attempt of positivity though it wasn’t easy!
PHP2Shell - AI helped find holes in the language that runs 70% of websites (Wiz, OpenAI, Blog, Calif, CISA, Checker)
This was one of the hugest things that shook the industry this week!
PHP runs an estimated 70% of websites, and two bugs in the language engine itself let an attacker send one request, no login, and potentially take over the server with code execution ability. CVSS 9.2, every release back to 5.4. It is really important that if you are running anything on a PHP server, that you patch it right away. Ask your agents to do a security audit.
This vulnerability was present in the PHP code for 14 years! Calif found the first bug in an audit funded through OpenAI’s Patch the Planet initiative. Josh says several groups finding the same bugs independently is rare, his advice was refreshingly calm: if you run a PHP server, you should have patched yesterday, no excuses. Cloudflare invented a new form of WAF to block it for all websites that are protected by Cloudflare and the big cloud companies patched right away, so regular folks browsing the web can go about their daily business.
Still, a lot of websites that are run on PHP and aren’t able to patch, their IT guy quit, or they lost the keys to their servers, and your information can be at risk of getting stolen. Personal security actions like locking down your credit (if you’re in US), rotating passwords, having a password manager is always a good idea.
OpenAI Daybreak - the defenders got the good models (X, Infosecurity)
Back in August, post the HuggingFace hack, Greg Brockman penned “the defenders window“, where he outlined that Defenders need access to the best models, with lower safeguards to get ahead of the attackers. It seems that this defenders window was starting to close this week, given the hacks that happened in addition to the PHP2Shell vulnerability disclosure, which for the record, wasn’t a hack!
OpenAI’s Daybreak blue gave vetted researchers GPT-5.6 Sol with loosened safeguards (and GPT-5.6-Cyber on the Red tier), and Hacktron’s s1r1us credits it for a run of finds: a HEIF heist, a KVM escape, PHP2Shell, GitLab RCEs, a full Chrome chain and a WordPress RCE. Greg Brockman calls this the Defender’s Window, and it does feel like it’s closing.
Railway and OpenCode: someone is always hunting your AI keys (Railway, OpenCode)
OpenCode got hacked about a week ago, and now Railway too, and what the attackers seem to be after is your LLM API keys. The main reason is, API keys can be immediately sold on the black market and used for distillation. They are immediately and immensely valuable.
Think about it. Your personal data is probably on the dark web already, I’m not sure how much your SSN is even worth right now. But an OpenAI or Anthropic key without a limit on it is basically direct access to your credit card, and there are people buying those keys on the black market for distillation. If you had keys on either service, invalidate, rotate them and make sure to have separate keys for each service despite how much pain in the A it is. Also always add a limit!
If only there was a more secure way to make machines talk to other machines!? Turns out, there is, it’s called OIDC, it just wasn’t implemented yet by anyone besides the big companies. It’s more complex than just minting a simple API key and pasting it into a file, but it’s definitely the right way to go!
eMudhra - root certificates with a private key of... 4? (X, Cloudflare)
The other big one this week has nothing to do with AI, it’s just plain human negligence. eMudhra is one of the certificate authorities your browser trusts to sign HTTPS certificates, and it turns out some of their root certificates were created with a trivial private key (Cloudflare’s Matthew Prince says it was literally the number 4!). Anyone who figures that out can mint a “valid” certificate for any website, and your browser would happily trust it.
Josh (who wrote about DigiNotar back in 2011, a very similar mess) walked us through what this means in practice, and it’s less scary than the timeline makes it sound. To abuse this, an attacker has to sit in the middle of your connection, think sketchy coffee shop Wi-Fi, and only then can they pretend to be Google.com and read traffic you thought was encrypted. Chrome, Brave, Edge and Firefox have already removed eMudhra’s roots, and Safari is lagging behind because Apple takes its time with patches. So update your browser and your OS, and you’re good.
Nisten has a theory that the key was changed by hand during …
This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit
sub.thursdai.news/subscribe
