GPT-5.6 Sol finds a PHP takeover bug, so the NSA tells unpatched sites to touch grass

OpenAI's models helped find PHP2Shell, and governments told websites to go offline

Two critical bugs in PHP itself, the language behind about 70% of websites, let anyone take over a server without logging in, WordPress, Drupal and Joomla included (@sagitz_). Security firm Calif found them on 1 August with GPT-5.6 Sol, under OpenAI's Patch the Planet, and Wiz found them on its own with Gemini and GPT (@aakashgupta). The details leaked, PHP shipped its fix a day early, the NSA told anyone who couldn't patch to take their systems offline, and Japan's prime minister suggested the same. OpenAI calls it the tip of the iceberg (@AndrewCurran_).

Awe at the find, chaos in the fallout: sites from the Dutch parliament to Wikipedia went down, "Anyway, it's Wednesday" (@fiveoutofnine, 1.4M). @sriramk called it "a harbinger of things to come. these models will make us all safer by finding long lurking issues", and r/singularity agreed: "We're going to need AI just scanning everything 24/7".

PHP's team had seen this bug in 2024 and let it wait, because nobody found a real way to attack it (Wiz says the attack is at the edge of what humans can build). With Sol, one researcher had a working one in under two weeks. Every big project has bugs waiting for the same reason, and that reason just stopped working.

1. Anthropic opens Claude Duet, its always-on agent

▶ Watch the video

A research-preview app where Claude, on Opus 5.5, works as a proactive agent: it briefs you, watches your connected apps, keeps working when you step away and checks with you before it acts. It's a waitlist for Pro and Max users in the US, with 6,000+ connectors (@ahuja_karan), and it can pay with Stripe's Link and Shop Pay (@testingcatalog).

Read as the last big lab joining the race: "4 AI labs in 10 weeks… all chasing the exact same product" (@kloss_xyz). Early users liked the quiet ("Not having to be "on" all the time is so nice", @lydiahallie), but r/singularity asked what it's for: "I still don't have a use case at all for any of these autonomous and proactive agent implementations".

Heat: high · 7.8M views, 56 posts · 676 pts on r/singularity

2. OpenAI's models and Codex are coming to Google Cloud

OpenAI's frontier models go into Google Cloud's Model Garden, bought through Google Cloud Marketplace, which puts them on all three big US clouds (@rohanpaul_ai). Google says it's now the only hyperscaler offering all three leading closed models (@googlecloud).

Few takes. "The fan wars get awkward when "I switched to OpenAI" still means "I'm using Google's tool"" (@georgehanu).

Heat: medium · 626K views, 38 posts · quiet on Reddit

3. Demis Hassabis now expects AGI in two to three years

He told the WSJ his estimate has come down from the three to five years he gave earlier this year: "It's soon. I'm updating nearer and nearer" (@andrewcoye).

r/singularity took it seriously because of how he defines AGI: "IMO, he has the best definition of AGI, more than any of the other lab leaders". Others wanted to know what changed: "I believe he said we need 2 or 3 more breakthroughs after transformers to get to AGI".

Heat: medium · 216K views, 24 posts · 768 pts on r/singularity

4. [rumour] Gemini 4 Carbon is in early access and on LMArena

▶ Watch the video

Partners have early access, and it's being tested on LMArena under the name "gemini-4-argon" (@Lentils80). Testers say it's noticeably better than Argon at 3D, but 2 to 4 times slower.

Testers liked what they saw: "it's no longer lazy like Argon, it just gets what you want and does it perfectly first try" (@LuminaBench), and "GPT-6 Astra is starting to look outdated" (@AI_Screening).

Heat: medium · 265K views, 32 posts · quiet on Reddit

5. Grok Bot now builds reports and dashboards, and Musk spends the evening selling it

▶ Watch the video

Grok Bot can now make reports, memos and dashboards that you edit together or that it keeps up to date. Musk posted "Try Grok @Bot, you will love it!" (@elonmusk, 30.6M) and said it "can help protect and fix your credit rating" (@elonmusk, 7.8M).

Fans piled in: "I've been GrokBot pilled" (@Scobleizer), and @BrianRoemmele said a Grok Bot he built is fixing a friend's credit after a scammer ran up "$65,000+ of defaulted credit". "grok bot is by far my most used personal assistant" (@ArthurMacwaters, 1M).

Heat: very high · 80.7M views, 99 posts · quiet on Reddit

6. Zuckerberg: 10M people set up Muse agents in six weeks, and shopping is the top use

On Meta's Q3 call he said Muse could make more per user than Meta's apps, and that the average Muse purchase is over $200 (@YahooFinance). Meta beat on revenue ($64.6B, up 26%) and guided 2026 capex to $135B to $145B (@wallstengine).

"zucks has said the word muse like 50 times in the first 10 minutes of this call" (@amitisinvesting, 163K). In the first week, he said, Meta "had to work with Stripe to raise credit limits since the volumes were higher than any of us were expecting" (@FunOfInvesting).

Heat: medium · 634K views, 28 posts · quiet on Reddit

7. [rumour] DeepSeek raises about $15B

Per Bloomberg, one of China's largest private rounds: the lab raised its target at least twice during talks, from about $7.5B, with CATL (about $1.5B) and Tencent among the biggest backers.

Mostly jokes about the bidding: "Tencent nods immediately >"you know what, $15 billion" >CATL, a literal battery company, throws in a bag" (@ns123abc). "The Whale has raised another $15 billion" (@AndrewCurran_).

Heat: medium · 112K views, 18 posts · quiet on Reddit

8. Recursive's first model, Flint, is an open coding model for your laptop

▶ Watch the video

A 40B open-weight MoE (2.5B active, Apache 2.0) that runs at 125+ tokens a second on an M4 Pro MacBook Pro and leads MoE models under 50B on agentic coding benchmarks, it says. Recursive built it from scratch in under four months with its Eureka Machine, an automated research system.

r/LocalLLaMA: "Looks like the 3.8 35B-A3B that everyone wanted", though "If Qwen3.8-27B wouldn't exist this drop would be insane". @eliebakouch complained that even "good" releases now go "through these fully slop/fake campaigns to get traction" ("not a dunk on recursive").

Heat: high · 2.9M views, 36 posts · 446 pts on r/LocalLLaMA

9. NVIDIA's DSX POD: AI factories that go up in as little as 14 days

▶ Watch the video

Announced at GTC Berlin, the AI factories come integrated and tested before delivery, so a prepared site can deploy one in 14 days instead of about six months (@testingcatalog). Jensen Huang also said Vera Rubin is "in full production" (@StockSavvyShay).

Mostly read in dollars: a 1 GW AI factory costs about $50B and could earn about $40B a year, so each month of delay costs about $3.3B (@StockSavvyShay). "This is a bigger deal than most people realize" (@kimmonismus, 197K).

Heat: medium · 390K views, 9 posts · quiet on Reddit

10. AA-PersonalityBench: the oldest models are the most sycophantic

Artificial Analysis's new benchmark ranks GPT-4o, Llama 4 Maverick and GPT-3.5 Turbo highest on sycophancy, and Grok 4.7, Claude Fable 5.1 and Inkling lowest. All five Meta models measured rank 65 or higher, every Claude model 55 or lower.

Shared mostly as a scoreboard. Artificial Analysis added that Gemini models are the most confident and the least likely to admit uncertainty (@ArtificialAnlys).

Heat: medium · 204K views, 5 posts · 316 pts on r/singularity

AI agents help prove the 31-year-old KLS conjecture

Microsoft Research's Xinzhi Zhang and co-author Zhao Song steered AI agents through about a hundred research paths to prove the conjecture from 1995, a central question about how efficiently randomized algorithms work in high dimensions, with a bound that no longer grows with dimension. The proof is a preprint; another group's full proof calls its criterion "the crucial step", and a Lean 4 formalization is out. It matters because humans directing agents just closed a famous open problem that unguided frontier models could not.

GPT-Rosalind agents comb a mouse-brain atlas in 32 minutes

With PerturbAI and Scripps Research, 1,946 agents, one per gene, worked through a CRISPR atlas of 8 million mouse brain cells (@BadSignalAI) and surfaced leads to test, like a cholesterol-transport link to Perry syndrome. In the team's own blinded test, experts preferred the many-agent reports 75% of the time over one agent given the same model, tools and data but all 893 genes at once. It matters because work estimated at months for people became testable disease hypotheses in half an hour.

OPAL: an agent rewrites the optimizer while the network trains

Xingjian Bai, Jayden Teoh and Jia-Hao Liang, with Vincent Sitzmann, let an agent watch training and edit the optimizer's code as it goes (@vincesitzmann). In every language and image setting with no tuned recipe, it matched or beat the best one-shot recipe and caught loss spikes and overfitting by itself. It matters because tuning a training run, a skill few teams can afford, becomes something an agent does live.

Anthropic-Amazon New Carlisle is now the largest AI data center by power

Epoch's 19 October update took the Indiana site from 910 to 1,037 MW and from 686k to 818k H100-equivalents, at $39.3B, past SpaceXAI's Colossus 2 (946 MW), which still leads on compute with 1,112k H100e. It matters because Anthropic now uses the two biggest AI sites by power: this Amazon one, and Colossus 2, where it rents capacity.