Thursday, 22 October 2026 / transcript
Transcript — Thu 22 Oct
0:00 / 13:52
Maya and Alex are AI voices. Each part of the conversation below comes from one item in the written edition — linked above it — and is checked automatically before publishing: every number must appear in that item, every caveat the edition raises must be said aloud, the source must be named, and speculative or hyped language is rejected.
Intro
MayaIt's Thursday, October 22nd, and this is The AI Edge, presented by Epilogue.
AlexEpilogue builds AI for work where being wrong is expensive, and ships systems that know what they know, show their work, and fail visibly instead of quietly. Find out more at epiloguelabs.com.
MayaI'm Maya.
AlexAnd I'm Alex.
MayaHere's what happened at the frontier of AI in the last 24 hours, with a source behind every claim.
AlexThe three that matter most?
MayaPHP shipped emergency patches for two unauthenticated remote code execution flaws, and Wiz Research says demonstrating they were exploitable had been at the edge of what human researchers could practically achieve.
AlexMicrosoft attributes the ConnectWise Cloud Backup supply chain compromise to a China-state-aligned group it calls Storm-0940, and says the group reached privileged access in under three hours.
MayaAnd Anthropic opened a research preview of Claude Duet, a proactive agent built on Claude Opus 5.5.
Frontier models & labs — Anthropic opens a waitlisted research preview of Claude Duet, a proactive agent built on Claude Opus 5.5
MayaAlex, what is Duet?
AlexAnthropic calls it a new app where Claude works as a proactive agent, designed around Claude Opus 5.5. It's by waitlist, starting with US Pro and Max subscribers, and 9to5Mac reports the rollout is US-only and not yet on Team or Enterprise plans.
MayaWhat stops it doing something unwanted?
AlexAnthropic says Duet shows you what it plans to do and waits before it sends a message, makes a payment, signs a document or deletes anything. A few things are off-limits even with approval, and it gives trading securities and moving money between accounts as the examples.
MayaDoes Anthropic say where it falls short?
AlexIt does. Anthropic says Duet might misread a thread or miscalibrate what's urgent, and that it can't yet show you its browser. That's the company's own account, not independently verified. Anthropic hasn't published a figure for how often Duet gets urgency wrong, and the rejection rate of its sensitive-information classifier is unreported.
Transition
MayaTo the research, and what agents do once you hand them tools.
Research & papers — Models that refuse a harmful request in chat still make unsafe tool calls for 10 to 52 percent of the same requests
AlexA paper on arXiv puts a number on the gap between what a model says and what it does. It builds 2,304 prompts as matched triplets: the same request in text only, with tools, and with tools under an adversarial framing.
MayaAnd the finding?
AlexUnder ordinary tool-enabled prompting, models that had refused a harmful request in chat still made an unsafe tool call for 10 to 52 percent of those same requests.
MayaCan you steer that away?
AlexNot cleanly. The paper says restoring the refusal signal prevents only a subset of unsafe calls, mostly by suppressing tool use rather than producing safer ones. Steering nearly eliminates them only at strengths that also suppress harmless tool use or degrade the output.
MayaWhat's the caveat?
AlexIt's a preprint, not peer reviewed, and arXiv is the only source. The paper doesn't name the models it tested, so none of this can be pinned on a particular vendor.
Transition
MayaNow the story of the day, underneath most of the web.
Security, misuse & threat intelligence — PHP ships emergency patches for two 9.2-rated remote-code-execution flaws that frontier models proved exploitable after a decade
AlexPHP shipped emergency patches yesterday for two unauthenticated remote code execution flaws, both rated 9.2. CISA says they affect all PHP installations serving web requests, and tells anyone who can't patch to take their PHP systems offline.
MayaHow were they found?
AlexWiz Research says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout. Wiz says every PHP version released in the last decade is affected by at least one of them, going back to version 5.4.
MayaAnd what makes this an AI story?
AlexWiz says demonstrating exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve, and that frontier AI models substantially reduced that barrier.
MayaThe PHP Foundation's own account is unusually blunt about the delay.
AlexIt is. A core developer found the first signs of the same root cause in 2024, and a fix stalled over compatibility and resourcing. The Foundation says the delay was a structural failure, caused by both the security team's decision process and its lack of resources.
MayaWho reported the working exploit, and how exposed is everybody?
AlexThe Foundation says Calif's researcher Ryan A reported an unconditional remote code execution on August 11th, and that OpenAI independently reported the same root cause the same day. Palo Alto Unit 42 says it found over 22.6 million exposed instances potentially vulnerable. Those are company claims, not independently verified, and Unit 42 says it had seen proof-of-concept code but no confirmed exploitation of real systems when it published.
Security, misuse & threat intelligence — Amazon says a php2shell exploitation attempt hit its honeypots on 17 October, four days before public disclosure
MayaAmazon added a detail that moves the timeline backwards.
AlexThe AWS Security Blog says Amazon Threat Intelligence found an exploitation attempt dating to October 17th in its honeypot telemetry, four days before public disclosure, from an address tied to a commercial anonymization network. Amazon says it remains unclear how the actor got exploit information before disclosure.
MayaWhat's the general lesson Amazon draws?
AlexAmazon says AI-assisted analysis makes it cheaper to turn a patch diff or an advisory into a working exploit, so more actors can act within hours or even minutes once details are disclosed. Its advice is to measure patch timelines for internet-facing systems in hours.
MayaHow much of that is confirmed?
AlexThese are the company's own numbers from its own honeypots, a single source, not independently verified, and no other vendor has corroborated the October 17th attempt. Amazon says it's unclear whether any would have succeeded against real systems.
Security, misuse & threat intelligence — Researcher: thousands of AI-written php2shell proof-of-concepts need the target server to already have a severe flaw
MayaAnd there's a dissent on the record.
AlexThe researcher Elias Taylor writes that GitHub is full of proof-of-concept exploits for this vulnerability, and that they don't work against a plain, unmodified PHP instance.
MayaWhy not?
AlexHe says most lean on local file inclusion, so the exploit chain needs the server to already have a severe code-level vulnerability. He argues the AI tooling inserted that precondition, and that the identically shaped mistake across independent authors is because the model did the judgement for them.
MayaSo he thinks the alarm was overdone?
AlexHe says it isn't a Log4J moment, while adding an edit at the top of his post that you should patch anyway. This is one researcher on a personal blog, a single source, and it sits against Amazon's report of attempts in its honeypots. He doesn't claim to have tested every published proof-of-concept, and he doesn't address the chains Wiz and the Foundation say they demonstrated privately.
Security, misuse & threat intelligence — LiteLLM release pipeline hijacked with three developers' tokens; malicious 1.107.0 shipped a 16-module credential stealer
MayaAn AI gateway also shipped a backdoored release of itself.
AlexLiteLLM's own report walks through it. An attacker holding three sets of developer GitHub CLI credentials overrode branch protection, cleared the production approval gate with a second credential, and pushed seven malicious packages. The package index removed them at 13:23 UTC, and the container tags were cleared by 14:20.
MayaWhat did the payload take?
AlexWiz Research says it's a 16-module stealer: browser credentials and cookies, cloud credentials, API keys for model providers including OpenAI and Anthropic, plus SSH and GPG keys. Wiz says it also pulls provider credentials out of the proxy's database, up to 500 rows.
MayaAnd how did they get in to begin with?
AlexThat part is unconfirmed. LiteLLM says it suspects an innocuously named account on an internet-exposed internal deployment, and reports that Claude Code was said to sometimes embed a user's GitHub CLI OAuth token in response bodies, which could land in LiteLLM's logs where response bodies are logged. The company says that itself, it is not independently verified, and Anthropic has published nothing on it.
Security, misuse & threat intelligence — Microsoft ties the ConnectWise supply-chain compromise to China-aligned Storm-0940 running the ARTEX agent framework
MayaMicrosoft put a name to the ConnectWise compromise.
AlexMicrosoft says Storm-0940 was responsible, describes the group as China-state aligned and active since 2021, and says it used a framework called ARTEX as early as September 2026 against hundreds of organizations globally.
MayaWhat is ARTEX?
AlexMicrosoft calls it an open-source penetration testing framework of agents driven by language models, which runs an autonomous penetration test from reconnaissance through data exfiltration.
MayaWhat was the scale?
AlexMicrosoft says the actor hit more than 2,250 tenants at 2,900 sign-in attempts per minute, and that in multiple instances the time from first targeting to privileged access was less than 3 hours.
MayaHow solid is the attribution?
AlexThe counts are Microsoft telemetry and the attribution is its own assessment. Those are its own numbers, and no second vendor or government has confirmed them. CyberScoop notes Microsoft did not say how many customers were compromised, and that a successful login doesn't necessarily mean the group accessed or stole data.
Security, misuse & threat intelligence — CrowdStrike details four unreported actors running Claude Code as an autonomous pentester from exposed directories
MayaCrowdStrike described the operators themselves.
AlexIt documents four previously unreported threat actors active between May and August 2026, each of which left its offensive agent framework sitting in an open directory. All four were running Claude Code as an autonomous penetration tester.
MayaGive me one of them.
AlexA Spanish and English-speaking actor ran a supervisor agent and an executor agent on a harness built from an open-source project, hit at least 15 healthcare entities in Argentina, and took credentials and medical records from at least one.
MayaWhat's CrowdStrike's read on where this goes?
AlexIt says agentic AI can reach its objectives on its own, often within about an hour, and judges with high confidence that intrusions supported this way will almost certainly increase. These are the company's own numbers, not independently verified, a single source, and it doesn't say how many succeeded.
Military, defense & geopolitics — Pentagon releases Project Agincourt letter setting 1 October 2027 for a four-star Autonomous Warfare Command
AlexAn update on a story we've covered before. The command was announced on September 30th, 2026; what's new is the letter. NewsNation says it obtained a Department of War letter outlining the pathway to the Autonomous Warfare Command, led by a four-star general, operational by October 1st, 2027.
MayaWhat's the argument the letter makes?
AlexNewsNation quotes it saying that since the Cold War, American power projection has rested on a small number of sophisticated, expensive weapons, and that that model has been disrupted. Low-cost drones, it says, have changed the character, speed and economics of war.
MayaAnd the money?
AlexSOFX reports the FY2027 budget request includes about $54.6 billion for the Defense Autonomous Warfare Group. That's a request, not an appropriation. Neither outlet links the letter itself, and neither says what human-control standard will govern this command's systems.
Health, science & medicine — Google's multi-agent personal health agent published in Nature after more than 7,000 expert and user annotations
MayaTo health, where Nature published Google's personal health agent.
AlexNature describes a system that reasons over data from consumer wellness devices and medical records, built as an orchestrator plus a data science agent, a health domain expert and a health coach. They evaluated it across 11 benchmark tasks, with more than 7,000 annotations.
MayaWhat did the numbers show?
AlexIn a blinded comparison against baseline Gemini, 17 end users rated the domain expert agent's trustworthiness at 96.9 percent against 38.7 percent. But the full system is a far smaller win, and the paper says so: on complex queries, differences against the baselines ranged from 1.6 to 15.4 percent, averaging 4.6 percent.
MayaWhat should people hold back on?
AlexIt's peer reviewed, but it's Google's own evaluation of its own system, not independently verified, and no clinical outcomes were measured. Nature notes the records were limited to blood test results, and says the code will be released under an open licence, not that it has been.
Policy, regulation & law — Judge hears cross-motions on fair use in music publishers' lyrics case against Anthropic
MayaTo the courts, and the publishers' lyrics case against Anthropic.
AlexJudge Eumi Lee heard cross-motions for summary judgment in San Jose on October 21st, in a case brought in 2023 by Concord Music Group, Universal Music and others. The damages sought run up to $150,000 for each of 499 allegedly infringed songs.
MayaWhat did each side argue?
AlexThe publishers' attorney said Claude reproduces copyrighted lyrics, sometimes word for word, and that it couldn't do that if it didn't have the lyrics in the database. Anthropic's attorney argued the company has only secondary liability because users supply the prompts, and that there isn't anything in the record showing doom for the music industry.
MayaDid she rule?
AlexNo. Courthouse News Service says Judge Lee took the summary judgment motions under submission and did not indicate her views. The Epoch Times says the parties didn't get through all their motions, and that she asked them to consider continuing in late October or early November. Those accounts differ, and no ruling has issued.
Compute, chips & infrastructure — Nvidia says more than $300 billion of power equipment is backlogged and over 200GW sits in US interconnection queues
MayaOn compute, Nvidia put numbers on the power bottleneck.
AlexNvidia says power is now the biggest bottleneck in infrastructure, that more than $300 billion in equipment is backlogged, and that over 200 gigawatts of projects are waiting in US interconnection queues.
MayaAnd its answer to that?
AlexSoftware rather than generation. Nvidia says its tools let engineers simulate the grid, the substation and the AI factory together, and sync AI factory demand with grid conditions.
MayaHow much of that would you lean on?
AlexNot much yet. Every figure is Nvidia's, the company says them itself, and it doesn't source the backlog or the queue numbers. The 10 percent compute gain it cites is one partner's result on its own workload.
Deployment & impact — Barclays to cut 5,000 jobs, about 5% of its workforce, in an efficiency push it attributes to AI
MayaAnd a bank put a headcount number against AI.
AlexCNBC reports Barclays has revealed plans to cut 5,000 jobs, about 5 percent of its total workforce, as part of an efficiency push it links to AI, disclosed in its third-quarter earnings statement on Thursday.
MayaWhere do the cuts land?
AlexCNBC says about 60 percent of them are expected to be in support functions, including developers, and quotes the earnings presentation describing an outcome as organisational simplification and technology change efficiency driven by AI.
MayaWhy does that matter more than the usual remark about AI and jobs?
AlexBecause it's a specific headcount figure in a regulatory disclosure, not a line on a conference stage. That said, CNBC is the only source we opened for it, the AI attribution is Barclays' own, there's no breakdown of how many roles AI displaces as against ordinary restructuring, and Barclays didn't publish a timetable.
Outro
MayaThat's The AI Edge for today.
AlexThe full edition, with a link to every source, is on the site.
MayaOur voices are AI-generated.
AlexListen in tomorrow for the next edition.