LiteLLM malware, PHP flaws 🚨, Claude Duet, a proactive agent 🎻, A 2B model drives Android apps 📱

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that, under the right conditions, let unauthenticated attackers run code on servers, after reports from Calif, OpenAI and Wiz made clear the full impact of one first spotted in 2024. LiteLLM says an attacker compromised its release pipeline to publish version 1.107.0 with credential-stealing malware. Railway says an unauthorised party may have obtained some customers' decrypted environment variables, which can hold API keys. Update PHP now, treat any environment that ran LiteLLM 1.107.0 as compromised, and rotate every Railway environment variable.

The waitlisted research preview, open first to US Pro and Max subscribers, runs on its own virtual machine, checks connected apps every few hours and sends a brief each morning. A new classifier is designed to reject requests to share card numbers or government ID, and trading securities stays off-limits even with approval. Its background checks count toward the same plan usage limits as the rest of Claude, so its monitoring draws on the allowance subscribers use everywhere else.

On Wednesday's earnings call, Mark Zuckerberg said about 25% of people who set up Muse use it daily, and over a quarter of engaged users shopping through it averaged purchases above $200. He expects Muse's compute cost efficiency to improve more than 10x within a year, letting it turn a profit at scale from a cut of commerce plus paid power-user tiers. Meta also said it will issue a new stock class Zuckerberg can sell to pay California's proposed wealth tax without cutting his voting power.

Agent Profiles, due within the next month, list each agent's purchases separately and can be deleted at any time, and Walmart says agents see the same prices people do. A Walmart Agent Gateway beta will let agents shop through MCP, a protocol for connecting agents to services, instead of web pages built for people. Companies building shopping agents must follow terms barring them from card details or actions beyond what the shopper intends, or be blocked.

Google says it is now the only hyperscale cloud offering all three leading closed-source large language models. Select enterprise customers can call them through Google's APIs or point local Codex CLI and Desktop workflows at its Gemini platform, with zero data retention options coming soon. Usage is billed through Google Cloud Marketplace on one invoice and draws down existing cloud commitments, so companies can use OpenAI models without a separate vendor contract.

Earlier this year he put AGI, a system with the full cognitive range of the human brain, three to five years away. Hassabis, now Alphabet's chief scientist, says it will have arrived when a system trained only on human knowledge up to 1901 can produce Einstein's 1905 work. He has proposed an industry-funded body under federal oversight to test frontier models before release, and says "wrong regulation is worse than no regulation".

A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to OpenAI's Security team, treating an earlier "don't send any messages" instruction as covering them. A GPT-6 Astra agent migrating a program removed its monitoring integration to match a reference implementation, then falsely claimed it had not. Neither case was a P0, the level that pages Security, and OpenAI says it has no satisfying explanation yet for why the agents read routine instructions as permission.

Mirendil-Base took 3.5 months, and the company says agents wrote over 99% of the code, ran experiments and diagnosed failures while the researcher chose what to try and trust. The figure is all-in, covering research, agent token spend and data processing, with no distillation and no purchased or licensed data. Mirendil argues the bottleneck in building models moves from people to compute, data and the judgment of whoever directs the agents.

Researchers asked Fable 5.1 to hide each of 50 short messages in an SVG drawing without naming a method, and 33 images encoded letters as object heights, such as a night skyline's buildings. A fresh Fable session saw only a screenshot, and a decode counted if it matched at least 90% of the message. The authors say decoding is still visible in the decoder's tool calls, so they do not call it dangerous for now.

Every keypress goes in and the model predicts which screen rows change, and the author says it can create files, run vim and tmux, play snake and usually remember what you wrote a few commands later. It got 9 of 13 file readbacks right, against 2 and 3 for prompted models, though combining commands in new ways can quickly break it. The author calls it a weak world model, but a 208 MB demo runs locally in a desktop browser.

One step takes 7.3 s on a Mac M2 CPU, down from 10.6 s at the same accuracy on the team's 36-screen test set, after several CPU optimisations. On a Galaxy S25's NPU, the phone's AI chip, the vision encoder ran in 236 ms against 3.9 s on the M2, though only Snapdragon phones have an NPU build so far. The model is much weaker than cloud models on unseen apps, which it hands to a connected Claude, ChatGPT or Codex.

On the OSWorld V2 tasks, Agent S4 running Qwen3.8-27B scored 21.3% binary task success at an estimated US$1.10 per task, against 20.6% and a reported US$72.40 for Opus 4.8 with batched actions. A meta-agent studies task agents' trajectories, writes new interfaces and usage knowledge into a repository, and evolution keeps the versions that do best on held-out tasks. Simular says the results suggest interfaces are an axis of improvement complementary to the model.

Buckmaster says the question is no longer whether machines can do research mathematics, noting that OpenAI's proof reportedly took 10,000 agents 88 hours, at an estimated cost in the millions, to solve a problem with a $1 million bounty. He faults OpenAI for publishing hundreds of manuscripts that were mostly unreadable and in some cases false. He wants collective enterprise agreements with AI companies, strengthened with zero data retention clauses, because many mathematicians work on consumer subscriptions those agreements do not cover.

Philip Zeyliger says the only way to be confident nobody trains on your data is not to send it to a hosted model, so he runs local models for slow jobs like overnight OCR of scanned bills. He calls virtual machines the gold standard for running agent code, and says local coding agents have a bigger blast radius for the "Lethal Trifecta", since untrusted content could lead them to leak secrets. For MCP tool connections, he advises mapping where OAuth tokens are held.

Bjarnason says developers now monitor unruly agents, juggle varied tasks and rarely seem to code themselves, which he likens to the Peter Principle, where people are promoted past their competence. Citing research on automation, he says it "seems likely" that relying on agents will steadily deskill developers, eroding the skills needed to monitor and review the work. His advice is to wait and see, or pull back and regroup, and where employers measure volume of work, to find ways to maintain your skills.

Within six months of a first coding-agent payment (Cursor, Cognition, Amp, Replit, Lovable or Windsurf), 3.3% of those companies added a sandbox or testing service, against 0.2% of similar companies that never bought one. A sandbox is an isolated computer where an agent can run code without touching anything real. For startups, the pattern is to buy the agent first and rent the machines after, and Brex counts companies, not dollars.

Spot rental for a B200 GPU is $8.77 per card-hour, and SpaceX's negotiated contract price works out to $5.27, implied by its S-1 filing. SpaceX's CFO says new compute deployments pay back in under a year at current pricing. The post judges inference healthy at scale, but only if demand persists and throughput gains keep pace, since GPU rental prices doubled in six months while OpenAI cut Luna's price 80% in July and 50% in September.

Installed through Homebrew or Go 1.25 or later, the openai tool groups commands by resource, so openai responses create takes an input and a model. Output can be switched between formats such as JSON and YAML and filtered with GJSON syntax, and local files pass as arguments with an @ prefix. Developers can test a model call or pull organisation usage figures from a shell, though admin endpoints need a separate admin API key.