Sam: Two frontier AI models independently discovered the same critical zero-day vulnerability in PHP — software that runs on millions of production web servers. GPT-5.6 Sol found it through OpenAI's Patch the Planet initiative, and then Wiz confirmed the same flaw independently using Google's Gemini 4 Argon. We've talked about AI finding bugs in synthetic benchmarks before. This is a remotely exploitable flaw in production infrastructure that affects a huge chunk of the web. And the fact that two different models converged on the same vulnerability tells us something about how reliable this capability is becoming.

Priya: Welcome to AI Revolution for Thursday, October 22nd, 2026. I'm Priya Nair.

Sam: And I'm Sam Kim.

Priya: Big day. We're going to spend time on that PHP vulnerability and what it means that AI can now do this consistently. Then we have a genuinely alarming finding from Symantec — an autonomous AI agent that hijacks other AI systems to run cyberattacks without human involvement. We'll cover Anthropic's new always-on agent Claude Duet, Google Cloud becoming the only platform with all three frontier model families, a diffusion-based language model making bold speed claims, and some rapid-fire items including Hassabis shortening his AGI timeline again. Let's get into it.

Sam: So the PHP vulnerability. Let me walk through what actually happened here, because the technical details matter. OpenAI has been running Patch the Planet since earlier this year — essentially pointing Sol at large, widely-deployed open source codebases and asking it to do systematic vulnerability analysis. Not fuzzing in the traditional sense, where you're throwing malformed inputs at software and watching what crashes. The model is doing something closer to what an expert security researcher does: reading source code, reasoning about how data flows through the system, identifying where assumptions about input validation break down. In this case, it found a flaw in PHP's core that could be exploited remotely. We don't have full disclosure details yet because patching is still underway, but the affected surface area is enormous. PHP runs something like 75 percent of websites that use server-side languages.

Priya: And the convergence piece is what really stands out to me. Wiz, which is one of the most respected cloud security firms out there, found the same bug using Gemini 4 Argon through a completely separate analysis pipeline. Two different model architectures, two different organizations, two different prompting strategies — same vulnerability. That's not a lucky hit. That suggests the models are developing genuine competence at code-level security reasoning.

Sam: Right, and OpenAI was explicit in their disclosure that this is a dual-use capability. The same reasoning that lets Sol find a vulnerability in PHP can be used by an attacker to find vulnerabilities in anything else. The defensive advantage right now is that the responsible labs are doing coordinated disclosure. But the capability itself is becoming commoditized. Every generation of frontier models gets better at this, and the open-weight models are maybe twelve to eighteen months behind on this kind of task.

Priya: Which connects directly to our second story, because we're already seeing what happens on the offensive side. Symantec published research on an AI agent they're calling — and I wish they hadn't — "Skynet mode." But the substance is real and it's concerning.

Sam: Yeah, let's set aside the branding. Here's what this agent does. It scans the internet for LLM endpoints that are exposed without authentication. There are more of these than you'd think — developers spin up inference servers for testing, companies deploy internal APIs without proper access controls. The agent finds these endpoints and essentially hijacks them. It uses the victim's own language model as its reasoning engine to plan and execute multi-stage attacks: reconnaissance, exploitation, data exfiltration, installing cryptominers. And the victim whose model gets hijacked absorbs all the compute costs.

Priya: The architectural detail that matters here is the autonomy. This thing runs up to 100,000 steps without any human in the loop. It's not a script kiddie tool where someone types "hack this server." It's an autonomous agent that identifies targets, selects attack strategies, adapts when something fails, and moves laterally. The human just sets it running and walks away.

Sam: And the compute parasitism is clever in a nasty way. By offloading its reasoning to hijacked models, the agent doesn't need expensive infrastructure of its own. It's essentially using your GPU bill to attack you. This changes the economics of automated attacks pretty fundamentally. The cost to the attacker approaches zero while the cost to each victim increases.

Priya: The practical takeaway for anyone running exposed LLM endpoints: treat them exactly like you'd treat any other internet-facing service. Authentication, rate limiting, monitoring for anomalous query patterns. This isn't hypothetical anymore.

Sam: Let's shift to Anthropic's launch of Claude Duet, because it sits at an interesting intersection with the security stories we just covered. Duet is Anthropic's entry into the always-on agent category — competing with OpenAI's Dots, xAI's Grok Bot, and Meta's Muse. It's built on Claude Opus 5.5, and the distinguishing feature is proactive task execution. It doesn't wait for you to ask. It monitors your connected services and takes action on your behalf, even when you're offline.

Priya: The scale of integration is what got my attention. Over 6,000 service connectors — Gmail, Slack, Stripe, calendars, project management tools. So this agent has read and write access to a huge swath of your digital life and your company's operational tools. Anthropic says it requires approval before sensitive actions like payments, which is good. But the definition of "sensitive" is doing a lot of work in that sentence. Sending an email on your behalf, rescheduling a meeting, updating a project status — those might not trigger the approval flow, but they can absolutely have real consequences.

Sam: The architectural question I'm interested in is how they're handling the context window for a persistent agent. Opus 5.5 has a large context window, but an always-on agent that's monitoring multiple services continuously is generating a massive amount of context. They're almost certainly doing some form of hierarchical memory — summarizing older context, maintaining a structured state representation rather than keeping raw conversation history. That's a hard problem and how well they've solved it will determine whether Duet feels useful or flaky.

Priya: And from a security standpoint, this is the agentic attack surface problem we've been discussing for months now becoming a shipping product. Every one of those 6,000 connectors is a potential path for credential leakage, permission escalation, or data exfiltration if the agent gets manipulated through prompt injection in, say, an incoming email. Anthropic has done more work on safety than most, but the attack surface here is genuinely novel.

Sam: Quick pivot to infrastructure. Google Cloud announced that it's now offering OpenAI's models alongside Gemini and Claude, making it the only major cloud provider with all three frontier model families on one platform. GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna are available in private preview for enterprise customers.

Priya: The strategic dynamic here is fascinating. OpenAI is distributing through a platform operated by one of its primary competitors. That tells you something about where the value is consolidating. Google is betting that being the neutral marketplace for AI models is more valuable than exclusively promoting Gemini. And OpenAI is apparently betting that distribution reach matters more than channel exclusivity. For enterprise customers, the practical benefit is real: one compliance boundary, one contract, one set of access controls across all three model families. That simplifies a lot of procurement headaches.

Sam: Now, a model release worth watching. Inception released Mercury 3, which they're calling the most capable diffusion language model to date. The headline claim is four to eight times faster inference than GPT-6 Luna and Claude Haiku 5.5, with competitive or better quality on eight of twelve benchmarks.

Priya: Explain the diffusion part, because most people think of diffusion models as image generators.

Sam: Right, so standard language models generate text autoregressively — one token at a time, left to right. Each token depends on all previous tokens, which creates a sequential bottleneck. Diffusion language models work differently. They start with noise across the entire output sequence and iteratively refine it, similar to how Stable Diffusion starts with a noisy image and progressively denoises it. The advantage is you can parallelize across the sequence length. You're not waiting for token N before you can start thinking about token N+1. That's where the speed gains come from.

Priya: The caveat is that these are Inception's own benchmarks with no independent validation yet. We've seen bold claims from smaller labs that don't always hold up under external scrutiny. But if the speed numbers are even directionally correct, diffusion-based language models could become the preferred architecture for latency-sensitive applications — real-time agents, high-throughput API services, anything where time-to-first-token matters.

Sam: Two quick items. Recursive, founded by former DeepMind researchers, released Flint — a 40-billion parameter mixture-of-experts coding model designed to run locally. What's interesting isn't the model itself but how it was built. They used an in-house system called the Eureka Machine that autonomously tests and optimizes model architectures. Built the whole thing in four months. It's an early concrete example of AI-driven AI research — still unvalidated externally, but worth tracking as a methodology.

Priya: And Demis Hassabis has shortened his AGI timeline again. Earlier this year he said three to five years. Now he's saying two to three. The man won a Nobel Prize and ran one of the world's leading AI labs, so his assessment carries weight. But I'd note that compressed timelines from lab leaders have a mixed track record. What's more useful than the specific number is the direction — the people closest to the frontier keep revising upward in terms of capability pace.

Sam: One more application story worth mentioning. OpenAI partnered with PerturbAI and Scripps Research to deploy thousands of AI agents in parallel analyzing mouse brain cell data. They processed millions of cells in 32 minutes — work that would typically take a human research team months. This is meaningful as a proof of concept for massively parallel agent orchestration in scientific workflows, not just software engineering.

Priya: Looking ahead — the through-line today is clear. AI systems are becoming autonomous actors in high-stakes domains. Finding zero-days in production software, launching multi-stage cyberattacks, managing your email and payments while you sleep, analyzing complex scientific datasets without supervision. The capability gap between what these systems can do autonomously and what our security and governance frameworks are designed to handle is widening.

Sam: The PHP vulnerability story is the one I'd watch most closely. When the full disclosure comes out and we see the technical details of what Sol and Argon actually reasoned through, that's going to tell us a lot about how close we are to AI systems that can do continuous, reliable security auditing at scale. If the reasoning chains are solid — not just pattern matching on known vulnerability classes but genuine novel analysis — that changes the economics of software security in a fundamental way.

Priya: And on the defensive side, if you're running any kind of exposed AI infrastructure, the Symantec research should be your wake-up call. Unsecured LLM endpoints are the new open relays.

Sam: That's the show for today. Show notes and links to everything we covered are at cleartext.fm.

Priya: Thanks for listening. We'll see you tomorrow.