o0o0o0o / 004 22 Oct 2026
The new price of autonomy
AI agents keep gaining new abilities. Attacks on software, keys and infrastructure show what trust in digital systems really costs.
Editorial
The first three issues of o0o0o0o followed AI agents as they became a platform, changed the rules and stepped outside their frame. Issue four shows the bill. Autonomy has a price, and this week showed who pays it.
The biggest story is PHP2Shell. Two critical vulnerabilities in the language behind a large share of the web were found with the help of AI models, and within hours the fix became a recipe for attack. Cloudflare saw attempts grow from thousands to millions, and governments in Europe took sites offline as a precaution. At the same time we saw the first well documented attacks in which agents do almost all the work: one operator with the Cairn tool, one state actor with ARTEX.
In this issue
Contents
- 03EditorialTrust has become infrastructureWhat ties the stories of issue four together.
- 05SignalThe new price of autonomyAgents attack, agents defend, and control lags behind.
- 06SignalThe hacker who left almost everything to agentsCairn, 1,200 attempts and more than 100 break-ins.
- 07SignalFrom backup to global administratorStorm-0940, ARTEX and ConnectWise.
- 08SignalThe agent is the new insiderOpenAI incidents and Microsoft's answer.
- 09SignalDefense learns to move at the same speedPatch the Planet, Claude Security, Cloudflare.
- 10PHP2ShellA decade-old bugThe biggest security story of the week: PHP2Shell.
- 11PHP2ShellWhat exactly is affectedVersions, deployment modes and misconceptions.
- 12PHP2ShellFrom thousands to millionsExploit attempts and websites taken offline.
- 14Patch nowPatch nowPHP, LiteLLM, emSign and Oracle.
- 15SecurityWhen the release pipeline breaksHow LiteLLM 1.107.0 was compromised.
- 16SecuritySecrets in someone else's cloudRailway and OpenCode.
- 17SecurityEight keys and one ceremony mistakeeMudhra and trust in HTTPS.
- 18Model watchModels of the weekMercury 3, MiniMax, Beam and DeepSeek.
- 19StoryVoice becomes the interface for agentsMistral Voxtral 3.
- 20StoryThe agent that asks before it paysClaude Duet.
- 21PlatformsChatGPT ads arrive in SerbiaAnd OpenAI models on Google Cloud.
- 22MoneyMeta builds a network around its agentMuse, new shares and $145 bn.
- 23MoneyWho pays for the AI raceAnthropic, OpenAI and DeepSeek.
- 24MoneyNVIDIA as a central bankBackstops and circular deal risk.
- 25InfraEurope wants to make AIGTC Berlin, Vera Rubin and OpenShell.
- 27BuildPyTorch stops picking a chipTorchTPU, TorchNeuron and llm-d 1.0.
- 28BuildGitHub closes the door on bad packagesPackage Firewall, licenses, models.
- 29BuildCOBOL is no longer a barrierOpenAI and low-resource languages.
- 30Use thisTokens that expire on their ownGitHub CLI in three steps.
- 31LabA 31-year-old problemThe KLS conjecture, people and agents.
- 32LabThousands of agents over a mouse brain32 minutes for months of work.
- 33OrbitTen grams of PhobosJapan's MMX mission is on its way.
- 34Follow upWhat happened since the last issueSix threads from issues 002 and 003.
- 35ShippedShipped this weekWhat is actually available.
- 365 minutesIn briefEight stories in five minutes.
- 37NumbersThe week in numbersTwelve numbers with sources.
- 38NextWhat we are watchingDates and developing stories.
