The week AI started finding the holes in the internet. Two teams, one using OpenAI's models and one at Google's Wiz, found a pair of remote code execution bugs in PHP that have been there for fourteen years. PHP runs most of the web, so Finland and the Netherlands took government sites down until they could patch, Wikipedia switched systems off as a precaution, and Cloudflare watched exploit attempts go from thousands to millions within hours. In the same week an Indian certificate authority turned out to have issued certificates whose private key was, literally, the number 4. My read: this gets worse before it gets better, because so far the pace is being set by companies auditing their own code, not by attackers using the same tools. If you run your own servers and haven't kept up with patches, this is the moment to move to a managed service, which is an awkward thing to say if you've been vibe-coding your own web tools. The open question is where it settles: a world of many more attacks on many more targets, or one where AI has found most of the bugs that would otherwise have surfaced one by one over the next decade. And assume the NSA and the Chinese knew about some of these already.
The other story is money. Anthropic's draft IPO filing shows about $16bn of first-half revenue and roughly breakeven at the operating level, once you set aside a $72bn paper charge on convertible notes and the stock comp. Inference makes money; all of it goes into training the next model. Ken Griffin says this is almost certainly a bubble and I agree, for what that's worth. Meanwhile the consumer agents are finding out that marginal cost breaks the old playbook: Zuckerberg says Muse has 10 million accounts and clear product-market fit, but it's so expensive to run that he won't scale it until costs drop tenfold. You can't make it free, grow, and figure out revenue later. So OpenAI's Dots need a $100 plan, Grok Bot needs $30, and Anthropic's new Claude Duet comes with the $20 one, all with usage caps. Amazon is blocking Muse; Walmart is letting agents in. Both are right about their own businesses. Two smaller things worth a look: Starlink briefly stopped working for anything moving fast in Ukraine, on Musk's say-so, until Trump rang him, which is the strongest argument yet for weapons that don't depend on anyone's satellites. And Palmer Luckey is now breeding genetically modified dogs for the army.