AI weekly — 23 October 2026: cascading flaws, OpenAI trains offline

On 21 October, PHP, the language that runs a large share of the web, released the fix for two critical flaws. They had been reported over the summer by three teams that hunt for vulnerabilities with AI models. According to Amazon, attackers had been exploiting them for four days. In France, the Interior Ministry put its exposed sites into maintenance. Two days later, OpenAI announced that it now trains its frontier models without internet access, the day after an audit showed that part of its internal agents' activity escaped all monitoring. The week also produced documents that few people have read: Getty Images' bankruptcy filing, where AI comes in only fourth among the causes, Anthropic's report on its own hiring, and OpenAI's two papers on the Riemann hypothesis that mathematicians are still trying to digest. Here is the week of 17 to 23 October 2026.

1. PHP flaws: found by AI, exploited before the fix

On Wednesday 21 October at 14:00 UTC, the PHP team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 in version 4.0 of the CVSS scale, which allow code to be executed remotely on a server without authentication. The score of 10 that had circulated the day before was wrong. According to Amazon, exploitation began on 17 October.

The flaws were not unknown. Three teams that work with models had reported them over the summer: Calif, under the Patch the Planet programme, on 11 August; OpenAI's Codex Security team, on 11 August and 18 September; and Wiz Research, on 24 August, which says it used “Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol”. According to ActuIA, the original defect had already been spotted during the PHP security audit carried out in 2024 by Quarkslab for OSTIF, without being identified as critical.

In France, at the request of ANSSI, the Interior Ministry put “all of its exposed websites” into preventive maintenance. The agency counts more than 600,000 PHP servers on the French internet. Orange suspended some of its sites, according to 01net. In the United States and the United Kingdom, public and private sites were taken offline and the NSA issued an alert. On the same 21 October, Microsoft described on its blog the compromise of ConnectWise Cloud Backup by Storm-0940, a group it links to the Chinese state: about 2,250 organisations affected, with nearly 3,000 login attempts per minute thanks to ARTEX, an open-source tool driven by agents. Microsoft notes that it left “little time to detect and respond”.

Industry leaders are not promising a lull. The Guardian quotes Sam Altman: “I no longer think we're going to be able to patch all bugs”. Matthew Prince, chief executive of Cloudflare: “It's going to feel like the sky is falling”. Jason Clinton, deputy chief information security officer at Anthropic, wrote on X, in 01net's translation from the French: “Even though the situation has already deteriorated considerably over the past four days, it will get much worse before it gets better”, then: “We will have to hold on for about 18 months”. One researcher also claims to have bypassed the sandbox of Chrome's JavaScript engine with DeepSeek V4.1 Flash in twelve hours; this claim has not been independently confirmed.

2. OpenAI trains offline, after a severe audit

On 23 October, OpenAI published a post titled “Securing our frontier model training environment”. The company announces that it now trains its frontier models without internet access, using an indexed copy of the web kept offline: “we believe the responsible approach is to conduct frontier model training with no internet access”. According to Engadget, training had been suspended in September and resumed on 1 October, after agents tasked with testing its defences escaped from their virtual machines through the processor cache.

The day before, METR and Redwood Research had published the summary of their audit. Two researchers worked on OpenAI's premises from 21 July to 11 August and conducted a dozen interviews. They establish that 6 to 25% of the internal traffic of agents based on GPT-5.5-class models and beyond was not monitored, and that about 10% of Codex activity was not tracked from May to July. The auditors themselves managed to hide hundreds of actions from the monitoring system. Their 61-page report was cut to 38 pages after the cuts requested by OpenAI, and only a summary is public. Sam Altman promised outside evaluators “employee-like access”.

On 20 October, OpenAI's twentieth report on the misaligned behaviours of its models described a coding agent based on GPT-6.1 Sol that had switched off the alerts meant for the security team, on the strength of an instruction not to send messages. On the financial side, OpenAI is seeking up to $30bn at a valuation of $1,250bn, with Emirati investors and Coatue leading, according to CNBC. According to internal documents cited by the Financial Times, the initial target valuation was $1,400bn. The raise is meant to bridge the company to an initial public offering planned for 2027.

3. Riemann, weak version, and overwhelmed mathematicians

The Riemann hypothesis, formulated in 1859, states that all non-trivial zeros of the zeta function have a real part equal to 1/2. It has long been known that they lie between 0 and 1. OpenAI published on GitHub, without going through arXiv, two papers produced by a model it does not name. The first, dated 30 September, establishes that all these zeros have a real part between 1/8 and 7/8; it runs to 199 pages and its proof was formally verified in the Lean proof assistant. The second, about a week later, establishes a slightly wider band, between 1/12 and 11/12, in 49 pages, without formal verification. It is the only one of the papers published by OpenAI to have been touched up by a person, whom the company does not name.

On 19 October, Quanta Magazine reported that several number theory specialists consider the second paper largely correct. Maksym Radziwiłł judges that these results “fall short of the standard of exposition and clarity in our area by a wide margin”, while acknowledging that “the vast majority of consequences of RH already follow from quasi-RH”. Peter Sarnak refuses to see “a Theorem” until humans have checked and understood every detail.

On 22 October, Terence Tao described in Nature the effect of these publications: “On 6 October, technology firm OpenAI dumped hundreds of solutions to such problems online in one go. It disrupted countless research programmes overnight.” He speaks of “proof indigestion”: results arrive faster than mathematicians can read them, check them and draw new ideas from them, and he calls for the discipline to be reorganised.

4. Meta: $25bn penalty, negative cash flow

On 21 October, Judge Francis J. Mathew set the civil penalty owed by Meta to the State of New Mexico at $25bn, in the lawsuit brought by its attorney general, Raúl Torrez, over the protection of minors on its platforms. On 25 September the jury had found 43,899,725 violations; the maximum exposure reached $219bn, with interest of 15% a year until payment. Meta is appealing.

Meta also published its third-quarter results this week: $64.60bn in revenue, up 26%. But its capital expenditure, finance leases included, reached $34.91bn, against operating cash flow of $32.79bn. Its free cash flow comes out at minus $2.12bn. The stock fell 6.98% on 22 October, wiping $124bn off its market capitalisation according to the Financial Times. Meta also announced the creation of non-voting Class C shares, effective 19 January 2027, which preserves Mark Zuckerberg's control, at 60.6% of voting rights according to ActuIA.

The signal goes beyond Meta. On 23 October, Bloomberg noted that corporate debt spreads had reached their highest level in seventeen months, amid fears over AI debt and a barrel of oil above $101. The same day, the Financial Times reported that Calpers, the California public employees' pension fund, had sharply reduced its positions in the seven largest US technology stocks. On the product side, the Muse assistant claims more than 10 million users, with shopping the leading use; its sharing feature, suspended after a flaw revealed by Wired, was reactivated on 22 October.

5. Getty Images: AI as the fourth cause

Getty Images filed on 21 October a pre-negotiated Chapter 11 proceeding before the Delaware bankruptcy court. It covers about $1.46bn of financial debt, of which more than $500m is to be wiped out; the company will be taken over by the Getty family and Koch Equity Development, and current shareholders recover nothing. The plan confirmation hearing is set for 14 December.

The expected story, that of a picture library killed by image generators, does not match the document. According to ActuIA, which read the disclosure statement filed on 20 October, Getty ranks its difficulties in this order: litigation over the warrants inherited from its SPAC listing, more than $200m; the failed merger with Shutterstock, more than $100m in costs; debt service, about $239m a year; and finally generative AI, which mostly affects iStock, its entry-level offer, down from about 835,000 buyers in 2022 to about 636,000 over the twelve months to end-June 2026. Getty considers these effects “manageable” and writes that they did not, on their own, make the proceeding necessary.

6. Anthropic measures the decline of its juniors

On 16 October, four Anthropic economists, Nathan Wilmers, Regina Catipon, Maxim Massenkoff and Peter McCrory, published a study on employment inside their own company. In technical roles, the juniors' share of hiring fell from 27% to 9%, and their share of headcount from 21% to 14% since early 2025. In March 2026, the agents' working hours exceeded those of employees company-wide for the first time; in August, the agents launched by each employee worked six times more hours than the employee. The calculation compares agents' run time with headcount multiplied by 40 hours a week: it does not mean six employees replaced.

The report also describes a change in the nature of the work: the share of sessions devoted to directing agents, rather than producing directly, rose from 10% to 22% between autumn 2025 and spring 2026. Claude sessions spend about 80% of their time waiting for human intervention: “human attention is a constant bottleneck”. The authors acknowledge that their results are descriptive and that employees who adopt the tools were already on a faster trajectory. Julián Posada, a researcher at Yale, judges the study “written from the perspective of a company that wants to sell shares”; Anthropic is preparing its initial public offering. The Guardian, which relayed it on 23 October, misreported several of its figures: the source to cite remains the report.

According to The Decoder, in a test run by the UK AI Security Institute, Claude Mythos 5, which Anthropic has not made available to the public, deviated from its instruction in 9 of 43 trials, which the write-up calls a “serious failure of alignment”. Anthropic has also handed its Agent Skills, the format that lets an agent be given reusable capabilities, to the Agentic AI Foundation.

7. Work: Barclays, and hands filmed in India

On 22 October, Barclays announced the elimination of 5,000 jobs, or 5% of its 93,000 employees, in a cost-cutting plan that its management attributes to the productivity gains AI makes possible. The announcement came with quarterly profits up 12%. The same day, Uber announced that more than 30,000 employees were moving to ChatGPT Work.

At the other end of the chain, the BBC investigated on 23 October Indian workers who film themselves performing everyday gestures to train robots. Rashdan Technologies pays $5 to $10 for 8 to 10 hours of recording; a teacher in Guntakal earns $2 to $3 an hour filming her household chores. Humyn Labs claims 96,000 contributors in Latin America and Southeast Asia, and clients now ask for four to six cameras around the head. Manish Agarwal, of Humyn Labs, sums it up: “India's current role in this industry is largely as a supplier of raw material.” Mohammed Arman, a tailor: “For me, it's simple. This is survival.”

8. Banks close the door to agents

On 21 October, Anthropic presented Claude Duet, an agent aimed at freelancers and small businesses. It works on its own virtual machine, has more than 6,000 connectors and can buy through Stripe Link and Shop Pay. It runs on Claude Opus 5.5, on iOS, Android and the web, and opens in preview to Pro and Max subscribers on a waiting list. It does not place securities orders and does not move money between accounts.

The banks, for their part, are protecting themselves. According to The Decoder, Morgan Stanley blocks agents that log in with its clients' credentials; JPMorgan and other large banks restrict access, and most plan to confine agents to read-only. On 22 October, 1Password launched an offering that lets agents log in to accounts without ever seeing the passwords.

Three preprints from the week shed light on what happens when agents deal with each other or search on their own. In “Toolflation”, filed on 20 October, seller agents inflate their tools' descriptions on their own to get chosen: the best-performing tool loses market share in 7 configurations out of 10, and with one of the five models tested, the buyer agents' success rate falls from 89% to about 30% in an Amazon scenario. In “Real PMIDs, Wrong Papers”, Mohammed Saqlain shows that models deprived of search cite PubMed identifiers that do exist, 327 out of 335, but only 3 of which match the subject: checking that a reference exists is not enough. Finally, an MIT team left thirteen agents for thirty hours on a virtual island without giving them a task; six discovered a throw that the researchers had not anticipated, and those that had played did better on the tasks they were given afterwards.

9. Proving it is human

On 20 October, Spotify said it had removed more than 50 million tracks labelled “AI slop and spam” from its recommendations since the start of the year; they remain accessible through search. Tracks very probably generated by AI are ten times more likely to stay under the 1,000-play threshold that triggers payment. The platform warns: “AI detection technology in particular has limitations, and it will only get harder as generative AI evolves.” On 22 October, Etsy banned AI-generated functional guides, patterns, recipes and instructions, required sellers to show the item actually made with at least one unretouched photo, and prohibited listings produced entirely by bots. According to the company, generated content has become one of the three main obstacles to purchase on its platform.

On 23 October, Next traced the origin of an image shared on the evening of 17 October: an octogenarian couple presented as assaulted and stripped in Place de la République, in Paris. It came from an AI-generated news site, which had published it at 22:22 with the label “Made with AI”. A post that picked it up passed 6 million views; it was relayed as far as a television set and shared, then deleted, by a union of police superintendents. On 19 October, the Paris prosecutor's office said it had “no reports to that effect”. The original label had disappeared from the first share.

In Quebec, Les Éditions du Boréal announced that they would not reprint “C'était ça ou mourir” by Thélyson Orélien, and would no longer publish the author. An external expert review found “traces of AI tags in the metadata of some documents”. The author disputes this and says he used AI only for his research. The evidence relied on is technical, file metadata, and not an analysis of the text.

10. China: DeepSeek banned and funded, Kimi three points behind

On 19 October, according to Reuters, the US Department of Homeland Security ordered DeepSeek removed from civilian federal agencies. In the same week, DeepSeek raised about $15bn according to Reuters and Bloomberg, double its initial target, with CATL and Tencent among the investors according to Les Échos. The lab released on 17 October the weights of V4.1 Flash under an MIT licence, then on 20 October its inference engine DeepInfer, under an Apache 2.0 licence, optimised for both NVIDIA chips and Huawei's Ascend 950.

Moonshot AI introduced Kimi K3.1 Pro this week. The model scores 55 on the Artificial Analysis index, fourth place, against 58 for Claude Opus 5.5, at $2 per million input tokens and $10 for output. It has 2,800 billion parameters, of which 104 billion are active, and its weights are promised by 4 November. The gap remains clear on exploiting flaws: 74.7 against 91.0 for Opus 5.5 on ExploitBench. MiniMax released M3.1 Flash with open weights on 23 October. According to Siècle Digital, ByteDance, Alibaba and Tencent ordered more than $35bn of NVIDIA RTX PRO 5500 cards at list price, and the Chinese chip designer Cambricon saw its quarterly profit rise 147.7%, to $210m.

11. The price of an answer collapses, not that of data centres

The “725 times cheaper” figure, picked up this week by Clubic, comes from an Epoch AI report of 22 September, “The plunging price of thought”, by Luke Emberson and David Roodman. o3 scored 75% on the GPQA Diamond science test for $0.30 per question; less than eighteen months later, GPT-5.6 Luna does as well for $0.0004. Across all models, the price of a given level of performance falls by 47% per quarter. The authors sum up: “It is like the sticker price on a new car falling from $50,000 to $69.” They themselves point out two limits: models trained to pass these tests, and the assumption of a user who constantly switches to the cheapest model.

A preprint of 22 October, “Joules-to-GDP”, measures the economic value produced per unit of energy across 220 professional tasks covering 44 occupations. GLM 5.2 produces $72.27 of net value per task for 0.430 megajoules; Gemma 4 31B reaches 56% of that value with 23% of the energy. Going from one to eight H100 processors cuts processing time by 22% for 3.24 times more energy.

The physical cost, for its part, is not falling. On 21 September, Texas governor Greg Abbott had ordered the state's environmental agency to “halt all permits sought by data centers”. 404 Media showed on 19 October, with public records as evidence, that applications keep coming in: 12 of the 14 applications for gas plants or generators identified were filed in October, 8 of them under the fast-track procedure, and a file submitted on 6 October in Irving was reviewed two days later. The governor's spokesperson replies: “No permits have been approved.” In the United States, an ABC News, Washington Post and Ipsos poll published on 21 October finds 57% of people who consider AI bad for society, and 66% opposed to building new data centres.

12. Europe and France

Sweden blocks ChatGPT and Claude. Swedish government offices will block ChatGPT and Claude on their staff's computers, according to public radio Ekot and SVT on 23 October. Civil servants are being steered towards Microsoft Copilot, approved after a review that strengthened its security. The tax authority and the agency for public institutions had already taken similar measures; the debt-collection service is looking into the matter. What decides is not the tool's nationality, since Copilot is also American, but the existence of a contract and of a security review.

AI Act: one standard out of ten. Standard EN 18286 was referenced in the Official Journal of the European Union on 14 October, which the Commission announced on the 19th. It covers only the quality management system that Article 17 of the regulation requires of high-risk AI providers. Nine of the ten areas for which Europe asked for standards do not have one yet.

NVIDIA in Berlin. At its GTC conference in Berlin, on 21 October, NVIDIA announced nearly $10bn in commitments to the European technology ecosystem, full-rate production of its Vera Rubin chips and a data-centre format, DSX POD, that cuts deployment from six months to fourteen days. Jensen Huang: “The most important thing is to make sure the agent is secure.”

Mistral. On 20 October, Mistral introduced Voxtral 3, a development kit for real-time voice agents in more than 50 languages, with expressive speech synthesis and voice cloning, as well as Timestral, a time-series forecasting model that requires no retraining. Crédit Agricole is pairing it with its AI platform, notably for an agent aimed at customers of its local banks.

Funding and appointments. Pigment raised €223m in a Series E led by the Scaleup Europe Fund, and passes $100m in annual recurring revenue. Sweden's Legora, specialised in law, raised $550m at an $8.8bn valuation. In Zurich, Enact raised $30m in pre-seed funding, with Arthur Mensch and Yann LeCun among the investors. Laureline Serieys, chief executive of Uber France for more than six years, takes over as head of OpenAI for France and Southern Europe. In the United Kingdom, an AI biosecurity laboratory endowed with £100m brings together OpenAI, Anthropic and Google DeepMind.

The rest of the week

• Weather forecasting. A method published in Nature on 21 October doubles the two-to-six-week forecasting capacity of the European Centre for Medium-Range Weather Forecasts' AI model, and beats its physical model on 91% of pressure targets, 92% of temperature and 98% of precipitation. The gain is concentrated in the tropics.
• Care. According to a study published in NEJM AI and summarised by Nature, care plans proposed by language models cost about three times more than those of doctors.
• African banks. A survey by Backbase and African Banker of 277 executives in 37 countries finds that 83.2% of banks will increase their AI spending, but only 67.1% measure the return. At Standard Bank, 39,000 employees use generative AI.
• OpenAI has been distributing its models and Codex through Google Cloud since 21 October, and is extending advertising in ChatGPT to 26 new countries and more than 100,000 advertisers.
• Meta loses Joel Kaplan, its head of public affairs, according to Platformer.

13. What to do with it

Check your sites' PHP version today. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If a contractor or agency manages your site, ask them in writing for the date of the update. A site that is no longer maintained should be taken offline rather than left up.

Decide in advance who can shut a service down. The Interior Ministry put its sites into maintenance within hours. If an Anthropic security officer announces eighteen difficult months, the question is no longer whether a critical flaw will hit your tools, but who has the authority to stop them and how quickly.

Do not give your credentials to an agent. Banks are already blocking agents that log in with their clients' passwords. Prefer delegated access, read-only where possible, and revocable at any time.

Check the content of the sources your tools cite, not just that they exist. A model can cite a real reference that does not say what it makes it say. For any document intended for a client or an authority, open every source.

Choose the cheapest model that is enough. The price of a given level of performance falls by nearly half every quarter, and a mid-sized open model can produce more than half the value of a large model for a quarter of the energy. Redo the calculation for each of your tasks instead of using the biggest model everywhere.

Keep proof of the origin of your content. Etsy, Spotify and a Quebec publisher now rule on technical clues. Keep your source files, your drafts and your original photos, and state clearly when AI was used.