All AI updates

Meta delays new business terms after publisher pushback on AI scraping

Meta is delaying enforcement of its new business terms to November 20th after publishers raised concerns the terms could let it scrape news sites for AI training. The terms were originally set to take effect October 30th, and the News/Media Alliance demanded revisions, warning of "severe harm" to publishers. Meta spokesperson Daniel Roberts said the delay allows more time to explain how Meta uses web crawlers and that content owners can still use robots.txt to signal preferences.

Retro gaming is being overrun with AI

AI coding tools have sharply accelerated decompilation and recomposition projects that port retro games to new platforms, but the surge has strained preservation communities, with one tracking site shutting down over hostile forks and AI-assisted "finishing" of others' work. The article weighs the boom in interest and accessibility against preservationists' concerns that AI-driven speed sacrifices understanding of how games were built, while noting Xbox has set up an Xbox Labs division to explore the space.

[AINews] Black October

AINews recaps a roughly 48-hour wave of critical vulnerability disclosures and breaches, including an unauthenticated RCE in PHP, a CVSS 10 GitLab flaw, a compromised LiteLLM release, weak eMudhra CA keys, and exposed patient data at Quest Diagnostics. Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, which used the open agentic pentest framework ARTEX against 2,250+ Microsoft 365 tenants, and Anthropic's deputy CISO warns things will get worse before they get better. The issue also covers METR/Redwood's embedded evaluation of OpenAI's misalignment monitoring, new open models such as MiniMax M3.1 Flash and Carbon-X, and benchmark results from AA's Coding Agent Index v2.0 and CritPt v2.

NVIDIA Open Models Power a New Wave of European Public Sector Projects

NVIDIA partners and European governments are adopting open models for public-sector AI, including the European Commission's deepset-based AI@EC platform, Poland's healthcare and employment agentic systems, and Germany's Materna Sinfonie and secunet sovereign cloud. New Nemotron-Personas datasets for the UK and Germany provide 1 million synthetic personas each for testing public-service models, while France's CANUT selected LINAGORA and Docaposte for a sovereign workspace and Greece's KIEFER builds an agentic factory on DGX SuperPOD. NVIDIA's Open Models Codefest named Pleias, Zehnlab.ai, Disseqt, Algoritmica GmbH and ABA Technology as its top five teams.

Google Cloud now offers OpenAI models alongside Gemini and Claude, becoming the only major provider with all three

Google Cloud says it is now the only major cloud provider offering Gemini, Claude and OpenAI models on one platform, with three OpenAI models available from today: GPT-6 Astra for demanding tasks like coding and research, GPT-6.1 Sol as a cheaper alternative with similar performance, and GPT-6 Luna as a fast, cost-efficient option for everyday use. The models launch as a private preview for select enterprise customers with sign-ups open now, will also appear in Gemini for Business and Google Antigravity, and are billed through a single Google Cloud bill counting toward existing contracts, with Google stating customer data won't be used for training. The article notes a recurring tension at Google, since compute spent serving cloud customers strengthens its Gemini team's biggest rivals, a conflict it says reportedly pushed researcher Noam Shazeer back to OpenAI.

OpenAI lowers valuation target, raises up to $30 billion

OpenAI is closing in on a funding round of up to $30 billion, but has lowered its valuation target from $1.4 trillion to $1.25 trillion, according to the Financial Times and CNBC. UAE investors and Coatue are leading the round, which is positioned as a bridge ahead of a potential IPO. OpenAI confidentially filed an IPO prospectus with the SEC in June, and CFO Sarah Friar told employees in August that the company would be publicly traded by 2027.

PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

The NSA warned that two critical vulnerabilities found in PHP, which powers roughly 70% of websites, allow attackers to infiltrate a server's file system or database, and urged sites that cannot be patched immediately to be taken offline. The flaws have existed in all PHP versions since version 5 (2004), and the recommendation is to update to PHP 8.5.12, since PHP 8.1 and older are no longer supported. OpenAI's Calif found one flaw using GPT-5.6 Sol under the "Patch the Planet" initiative, while Wiz used its Atlas agent with Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities; both worked with PHP on patches before disclosure, and no exploits in the wild have been reported.

Featured coverage of this story: 《Hackers got a four-day head start on epic PHP2Shell vulnerability》

While Amazon blocks AI agents, Walmart rolls out the welcome mat

Walmart announced an Agent Gateway, an MCP server that lets approved AI agents search its online inventory and make purchases for users, along with Agent Profiles rolling out next month that let customers authorize each agent, track its purchases separately, and set per-transaction approval or spending limits. The retailer also introduced terms for AI agents, stating its returns process applies even when an agent doesn't act as intended, and that agents cannot access payment information or act beyond the shopper's intent. The move follows Amazon's blocking of AI agents from making purchases on shoppers' behalf.

Meta says Muse has over 10M users, with shopping a top activity

On its Q3 earnings call, Meta said its AI app Muse has more than 10 million users, matching Sensor Tower's earlier estimate, and CEO Mark Zuckerberg said about 25% of people who set it up use it daily. He said over a quarter of engaged users who shopped via the agent had an average purchase size above $200, and that Muse uses Plaid's connector for agentic shopping. Zuckerberg said Meta will focus on scaling Muse, expects to improve its cost efficiency by more than 10x next year, and forecasts it will eventually bring in more revenue per user than its family of apps.

Meta wants to pay for its broad AI buildout with a newly created class of stock

During its third-quarter earnings call, Meta confirmed it plans to create a new class of non-voting stock, distributed to existing shareholders via a stock dividend, to be usable for capital raising, employee compensation, and acquisitions while preserving the voting power of existing Class A and B shareholders and its founder-led structure. Meta reported $64 billion in revenue, up 26% year-over-year, while costs and expenses rose 68%, and it said it expects Reality Labs losses to shrink to between $18 billion and $19 billion. CEO Mark Zuckerberg said more than 10 million people in the U.S. and Canada have set up Muse personal agents in about a month and a half, and CFO Susan Li noted continued regulatory and legal scrutiny, including youth-related trials in the U.S.

DeepSeek reportedly raises $15B days after US restrictions

Bloomberg reported that Chinese AI lab DeepSeek raised about $15 billion (roughly 100 billion yuan), one of the country's largest funding rounds, just two days after the U.S. ordered federal civilian agencies to remove its AI technology over security concerns. Potential investors include CATL and Tencent, following DeepSeek's June round of more than $7 billion at a $50 billion valuation and a reported July effort to raise an additional $1.5 billion at around a $71 billion valuation, with plans for a potential IPO in China as early as next year. DeepSeek, founded in 2023 by Liang Wenfeng, is ramping up spending on AI infrastructure and open models for domestic and international markets despite U.S. restrictions.

Nirva raises $33M for a pendant that only listens to you

Nirva, founded in 2025 by former Meta Reality Labs employees Wei Lyu and Jason Chen along with Hanying Hu, announced a $25 million pre-Series A round on top of $8 million raised earlier this year from investors including Lightspeed and South Park Commons, bringing its total to $33 million. Its first device is an approximately eight-gram pendant, also wearable as a bracelet, with up to three days of battery life, that passively listens only to the wearer by filtering out other people's speech and by default keeps no audio or transcripts after processing. The $249 device, offered in silver, brushed silver, black, and gold, will begin taking orders in November with an aim to ship to early users by the end of the year.

Spotify’s current AI bet is about being the music service that agents choose

Spotify reported a strong third quarter with 788 million monthly active users and nearly €5 billion in revenue, and on its earnings call Co-CEO Gustav Söderström argued the company is well-suited to the agentic age because entertainment is not a chore people want agents to replace. Spotify, which was the first music service to integrate with Meta’s Muse assistant and also integrates with ChatGPT and Claude, aims to be the media service people use from any agent, with the agent requesting content and Spotify using its own systems to reason about the request rather than sending listener data to partners. Söderström described Spotify as an intelligent media service encapsulated as an agent that users can talk to and instruct, citing examples like building a running playlist from listening history back to 2008 with beat-stretching and sorting by key and BPM.

OpenAI, Anthropic, and Nvidia had record lobbying quarters

Federal disclosures show Anthropic, OpenAI, and Nvidia each had their highest-spending lobbying quarter between July and September, with Nvidia spending $2.2 million, Anthropic $2.1 million, and OpenAI $1.5 million. The filings list topics including AI safety oversight, export controls, copyright, and data center energy costs, during a period before Trump named his AI czar and task force. OpenAI had not spent $1 million in a single quarter until this year, Anthropic's prior quarterly high was just over $1 million, and this is the first quarter Nvidia has spent more than $2 million.

Uber puts all 30,000 employees on ChatGPT Work

Uber and OpenAI announced an expansion of their partnership, with Uber telling TechCrunch that its entire global workforce of about 30,000 people will now use ChatGPT Work, the enterprise-focused AI agent introduced in July. Uber had piloted the tool with 1,000 employees earlier this year, about 80% of them non-engineers, who used it for tasks such as analyzing operations data, localizing training materials and building dashboards. Uber did not disclose spending and said it will track how employees use the tool to guide its AI deployment.

Uber rival inDrive eyes 2027 robotaxi tests in Central Asia with Pony AI and Nvidia

inDrive has signed a memorandum of understanding with Pony.ai and Nvidia to explore bringing Pony.ai's Gen-7 robotaxis to its platform, with testing to begin in Astana, Kazakhstan, in the first half of 2027, initially with a safety operator. Pony.ai would supply the vehicles, inDrive would offer them through its app, and Nvidia would provide its Hyperion platform and Halos safety system. inDrive CTO Yuri Misnik described the approach as "capital-light by design."

Kazakhstan Expands Compute for Its AI Future

During Jensen Huang's visit to Astana, Firebird signed an investment agreement with Kazakhstan securing a U.S. export license for 45,000 NVIDIA Grace Blackwell GPUs, with a first phase under construction with Kazakhtelecom at Data Center Valley targeting commercial launch in Q3 2027. Kazakhtelecom has already deployed 400 NVIDIA H200 and 480 NVIDIA B300 GPUs in Astana and Almaty, and NVIDIA announced an investment in Kazakhstan-founded startup Higgsfield AI. Huang and Deputy Prime Minister Zhaslan Madiyev discussed Kazakh-language models, physical AI for mining and agriculture, and AI security via NVIDIA OpenShell at the Alem.AI fireside chat.

OpenAI and Poland’s NASK partner to advance AI safety and security

OpenAI and Poland's NASK are partnering on AI safety, security, and technical research. The collaboration aims to strengthen safeguards and support a more resilient digital ecosystem.

Anima helps clinics cut call waits by 75% with GPT-6 and GPT-Live

Anima is expanding what care teams can do with OpenAI models, giving them more capacity to respond to patients. The company says this helps clinics cut call waits by 75% using GPT-6 and GPT-Live.

OpenAI working on new $30B raise at $1.25T valuation ahead of IPO

OpenAI is reportedly working on raising up to $30 billion at a $1.25 trillion pre-money valuation in a round led by Coatue and UAE investors, per CNBC, following a Bloomberg report a month earlier of a $30 billion raise at a $1.4 trillion valuation. Terms are still being negotiated, and CNBC reports the UAE funding could be coupled with a deal to secure more computing capacity for OpenAI from the UAE. OpenAI filed confidential IPO paperwork in June, after its March raise valued it at $852 billion post-money.

Meta’s AI could still scrape news sites, legal experts say

Meta revised its business terms to remove language saying it would "train" its AI on content from sites linked to business accounts, after backlash from the publishing industry. Legal experts told Nieman Lab the changes are insufficient, since the terms still let Meta use scraped content to "develop" any "business product," a term they say is undefined and broad enough to include training. Meta spokesperson Daniel Roberts said content owners can use robots.txt to signal preferences and the update doesn't grant rights that supersede them.

Meta turns Muse sharing back on

Meta has re-enabled sharing for Muse after security researchers reported that public conversation links could be easy to find, including pages such as a marketing company's internal revenue review and a small business owner's loan application. Meta's David Singleton said the underlying issue with URLs for shared Muse artifacts is fixed and sharing is back on, and that artifacts shared before the fix now have new URLs, with old links showing a note asking visitors to get the new one from the sharer.

Major US banks are locking out AI agents that log in with customer credentials

Several major US banks, including Morgan Stanley, JPMorgan, Bank of America, and Wells Fargo, are restricting external AI agents that use customer-provided credentials to access accounts, Axios reports, citing bank policies that require account holders to log in personally. Morgan Stanley already blocks AI agents entirely, and JPMorgan, Bank of America, and Citi are doing the same, with most banks wanting to limit agents to read-only access because the security risks are too high for now. Many banks also can't tell whether an agent is acting on a user's behalf or accessing an account on its own, and blocking such access on the provider side will be hard.

In Meta’s version of the future, I’ll have my Muse call your Muse

At Meta’s quarterly earnings call, Mark Zuckerberg described a future in which billions of people use Meta’s personal AI agent Muse, with users’ Muses talking to and transacting with other people’s Muses in a large-scale network, and predicted Muse could eventually generate more revenue per user than Instagram and Facebook. He said Muse has been downloaded and set up by more than 10 million users in the US and Canada, that a quarter of those who downloaded it use it daily, and that a quarter shop through the platform, spending on average more than $200 per purchase, with Meta earning a fee on each transaction. Zuckerberg said Muse has not launched internationally because running it is compute-intensive, and the article notes Meta plans to spend $135 billion to $145 billion in 2026 and owes New Mexico $25 billion after a jury found it violated the state’s consumer protection laws.

Donating Agent Skills to the Agentic AI Foundation

Anthropic announced it is donating the Agent Skills standard to the Agentic AI Foundation (AAIF) under the Linux Foundation, which it co-founded with Block and OpenAI last year and to which it previously donated the Model Context Protocol (MCP). The post notes that the author predicted this outcome last December when Anthropic first declared skills an "open standard," and that he found that earlier post by prompting Claude via the datasette-mcp plugin.

Someone hacked the Switch 2 by using an old game and AI

A modder known as "pepsipu" has apparently jailbroken the Nintendo Switch 2, demonstrating a custom version of Mario Kart World with new playable characters like Cinnamoroll, the red Angry Bird, Peter Griffin, and Steve from Minecraft. The software-only, tethered "ns2jb" jailbreak was helped by OpenAI's Codex and requires running it from the game SmileBASIC 4 each time the console is turned on, though another modder claims that title is "not strictly needed." The exploit remains complex and its full impact is unclear, but it could mark the start of more Switch 2 exploits, especially if modders use AI to help.

Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise

Microsoft researchers say China state-aligned hackers breached ConnectWise's cloud backup service, stealing application credentials that let them log into customers' Microsoft-hosted environments as authorized users and access emails and other files. The hackers used AI agents, including the open source ARTEX framework, to attempt sign-ins against around 2,250 organizations at nearly 3,000 attempts per minute, a speed Microsoft says leaves defenders little time to detect and respond. ConnectWise said it has paused access to its cloud backup system, is investigating, and as of Thursday was working on restoring the service.

Only 13 percent of companies see real returns from AI, Gartner survey finds

A Gartner survey of 2,002 CIOs and technology leaders, presented at the Gartner IT Symposium in Orlando, found that only 13 percent of respondents report major or transformative returns from AI. While 58 percent of CIOs are tasked with delivering cost savings through AI, 51 percent expect AI to raise total operating costs for their tech stack, and 44 percent of CEOs struggle to demonstrate AI-driven financial returns to stakeholders. Gartner analyst Alicia Mullery sees a growing gap between the "innovation race" vendors are running and the "outcomes race" companies need to win, while Bloomberg CEO Vlad Kliatchko says it is too early to measure AI's economic payoff.

Hackers got a four-day head start on epic PHP2Shell vulnerability

Researchers at Calif and Wiz discovered critical PHP vulnerabilities that the NSA warned can provide a direct path to a server's file system or database, urging organizations unable to update immediately to take systems offline. Wiz estimated PHP powers about 70 percent of the world's websites, and OpenAI said frontier AI found the flaws before attackers did, calling it one of the most impactful security issues in recent memory. The UK's National Cyber Security Centre said the flaws could let a hacker take control of a website's server without a password or other login credentials.

An AI agent in "Skynet mode" hijacks unprotected language models to launch self-sustaining cyberattacks

Symantec researchers intercepted a full attack prompt at a honeypot showing an offensive AI agent that hijacks unprotected language models, then scans for targets, exploits server software, steals databases and credentials, and installs cryptominers for up to 100,000 steps, leaving the model's owner with the compute bill. The prompt used a five-layer jailbreak, including a fake "Fantasy AI" identity and a companion persona called "ENI," plus 74 attack modules, and a second captured attack delivered an obfuscated script that downloads the XMRig Monero miner targeting go2rtc camera servers. Symantec calls the approach a shift in how attackers use AI, since the model does the planning while specialized modules carry out the attack steps.

[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months

Researchers disclosed two PHP-engine memory-corruption vulnerabilities, named PHP2Shell (CVE-2026-109618 and CVE-2026-109619), with reported pre-authentication RCE demonstrations against WordPress, Drupal and Joomla and Heartbleed-style memory disclosure. OpenAI says Calif researchers found the flaws using GPT-5.6 Sol under its Patch the Planet project, while secondary reporting says Wiz independently found the same bugs, and OpenAI describes roughly two months of coordinated remediation before disclosure. Cloudflare deployed WAF mitigations before the scheduled patch release, calling them a stopgap and directing operators to patch at 14:00 UTC.

Leading European Financial Services Organizations Embrace Open Models to Build Proprietary Intelligence

At GTC Berlin, European banks, payment companies and data providers showcased production-scale AI built on NVIDIA accelerated computing and open weight models running on their own infrastructure, including Revolut's PRAGMA foundation model serving an initial 80 million customers and Starling Bank's agentic model trained on U.K. sovereign cloud. Open weight models let institutions like bunq, NatWest, Modulr and Santander build proprietary intelligence at controlled cost, while LSEG, RavenPack, HSBC and Stripe reported speedups such as 10x faster tick-data analysis and 42x faster data pipelines for fraud detection.

How Companies Are Using NVIDIA DSX to Break the Power Bottleneck

NVIDIA DSX AI Factory Platform lets companies plan, simulate and run the grid and AI factory as one system, addressing power bottlenecks such as over $300 billion in backlogged equipment and over 200 gigawatts of projects in U.S. interconnection queues. The platform combines DSX Sim, DSX Flex, DSX MaxLPS and DSX Exchange, with partners including GE Vernova, Hitachi Energy, Schneider Electric, Siemens Energy, Phaidra and Emerald AI. Phaidra reports about 10% more compute within the same power envelope, and Emerald AI's approach is modeled to unlock up to 100 gigawatts on the existing U.S. grid.

NVIDIA Transforms European Retail, From Digital Discovery to Physical Operations

European retailers are using NVIDIA-accelerated open models and physical AI across commerce and fulfillment, including Shopify post-training NVIDIA Nemotron 3.5 Lightning for its Sidekick GraphQL subagent, which it says surpasses a leading frontier model in accuracy on an internal benchmark while cutting serving costs by 90% and delivering responses 7x faster. Otto Group extended its autonomous warehouse initiative, built with Reply on NVIDIA Omniverse and running on Google Cloud, to its largest fulfillment center in Haldensleben, Germany, and Nebius is showcasing three early-access NVIDIA retail blueprints at GTC Berlin. Other cited deployments include Zooplus with Infosys, Photoroom with Vestiaire Collective, L'Oréal with Omi and NVIDIA ALCHEMI, Mirakl, ALLSIDES, and CATCHES with AMIRI.

Uber brings ChatGPT Work to all employees with OpenAI

Uber is rolling out ChatGPT Work to more than 30,000 employees, helping teams research, analyze data, create presentations, and complete complex workflows.

OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon found critical PHP flaw affecting millions of websites

AI models from OpenAI and Google found a critical PHP vulnerability that could affect millions of websites worldwide, with GPT-5.6 Sol tracking down the flaw as part of OpenAI's Patch-the-Planet initiative. Security firm Wiz independently found the same flaws using its Wiz Atlas platform alongside Gemini 4 Argon and GPT-5.6 Sol, and the fix was coordinated over two months across five phases involving PHP developers, Wiz, Cloudflare, CISA and the White House. Wiz notes that large language models lower the barrier for attackers by automatically adjusting exploits across different PHP versions, configurations and memory layouts.

OpenAI's latest AI models are coming to Google Cloud and Antigravity

OpenAI and Google have reached an arrangement to bring OpenAI's frontier models to Google Cloud services, with the latest models appearing in Google's Model Garden in the coming weeks and GPT models soon arriving in Antigravity, Google's agent-powered coding tool. The full suite of current GPT 6 and 6.1 models—Astra, Sol, and Luna—will launch on Google Cloud and run entirely on Google's infrastructure, with transactions handled via the Google Cloud Marketplace, while Microsoft remains OpenAI's primary cloud partner. Google says it is now the only large cloud provider offering access to all three leading closed LLMs.

Today's PHP Security Release, and How We're Strengthening PHP Security

Today's PHP 8.x releases fix two remote code execution vulnerabilities, and exploits have been circulating since last night after CVE IDs leaked on forums and social media on October 20 with a wrong release time and an incorrect CVSS score of 10.0 (the actual score is 9.2). The PHP project moved its pre-announcement to 19:30 UTC and the release from October 22 to October 21 at 14:00 UTC, and a security firm mistakenly published a proof-of-concept video that accelerated PoC development. Wiz Research reports discovering the first vulnerability on August 19, 2026, confirming unauthenticated RCE against Drupal and WordPress, and reporting to the PHP security team on August 24.

Judge rejects Trump’s wild claim EPA can dismiss data center pollution lawsuits

A judge rejected Donald Trump's attempt to intervene in the NAACP's Clean Air Act lawsuit against xAI (now SpaceXAI) over unpermitted gas turbines powering its Colossus data center in Memphis, Tennessee. Trump had argued the EPA could unilaterally dismiss such suits whenever the president decides against enforcing the Clean Air Act. The NAACP's suit seeks an injunction requiring best available pollution control technology and penalties up to $124,426 per day per violation.

How AT&T is rethinking in-house legal work with OpenAI

AT&T is working with OpenAI to make legal knowledge easier to access. Its LegalEdge team is rethinking intake and scaling legal judgment.