Agentic AI this week

AI found the flaw sitting under 69.3% of the web

Chamath Palihapitiya’s 25 October note leads with the story that should have been everyone’s week. Two flaws were found in PHP, the language behind WordPress and, by his figure, 69.3% of websites. The flaws let a stranger take control of the machine running a site without logging in. Britain’s Office for Budget Responsibility took its website down. So did dozens of other UK government services, Australia’s cybersecurity agency, and government sites in Germany, France and the Netherlands — all pulled as a precaution while the fix went in.

The part worth sitting with is how they were found. Calif, a security firm working with OpenAI, found one using GPT-5.6 Sol. Wiz, the cloud-security company Google owns, separately found both using Gemini 4 Argon and GPT-5.6 Sol. “As expected in 2026, AI did most of the work here,” Wiz researcher Sagi Tzadik posted. The bugs themselves are not new — they are present in PHP versions going back to 2012, and a PHP developer spotted one in 2024, but nobody found a way to exploit it and the fix stalled.

Then the disclosure leaked a day early, partly through a video of the exploit that Calif posted by mistake, and Cloudflare’s CEO counted millions of attack attempts within hours of the release. PHP’s 21 October update closes it for anyone who can install it. The slow part is everyone else: on W3Techs data, about 48% of PHP sites run version 8.1 or older, which PHP no longer updates at all. OpenAI, which led the coalition of PHP maintainers and security firms on the response, committed $1 billion in subsidised access to its models for security work. Sam Altman’s read is that this gets stranger: models will “probably find bugs… outside of the normal threat model of what we think a hacker can do, hardware-level insane stuff,” and “I no longer think we’re going to be able to just patch all the bugs.” Separately, Microsoft documented a group aligned with the Chinese state using an open-source AI hacking tool to automate attacks on hundreds of organisations, and believes the same group was behind the recent breach of ConnectWise.

DeepSeek raised $15 billion two days after being banned

On 20 October the Department of Homeland Security published an order barring civilian federal agencies from buying DeepSeek’s products, and requiring them to remove those products along with any “third-party products and services developed using DeepSeek implementations.” DHS cites DeepSeek’s servers in China, which Chinese law lets the government access, and the possibility that the models “may contain malware or other security vulnerabilities.” The order gets reviewed within a year.

Two days later, DeepSeek raised about 100 billion yuan (~$15 billion) at a pre-money valuation of 500 billion yuan (~$75 billion). Reuters counts more than fifteen investors, with battery maker CATL and Tencent among the largest. On the same day as the DHS order it also released DeepInfer, the core of the software running its own inference service for V4.1-Flash on both Nvidia and Huawei chips, saying it shared the code to help others cut compute costs and energy use. Within a couple of days it had over 6 million views and 20,000 stars on GitHub. On capability, its updated V4.1-Flash-1017 scored 45 on Artificial Analysis’ intelligence index against 52 to 58 for the top US models — though Vals AI, averaging three runs, says it beat OpenAI’s GPT-6 Sol.

Amazon and Google quietly made leaving Nvidia cheaper

Also from Chamath’s note, and the item I think is most underrated: this week Amazon and Google each released a free tool aimed squarely at the thing that keeps AI companies on Nvidia’s chips — rewriting code to run on anyone else’s. Amazon says 85% of AI researchers and developers write in PyTorch, which on Nvidia hardware runs through CUDA, used by more than 7.5 million developers. “You often had to rewrite your code, revalidate it, and sink many weeks in,” Amazon CEO Andy Jassy said.

Amazon’s TorchNeuron runs PyTorch code on its own Trainium chips with a single configuration change and no rewrite. Google’s TorchTPU, built with Meta, does the same for Google’s TPUs with minimal changes — Google tried this in 2020 and that version required intrusive source edits; in an early test with stand-in model settings, 98% of 4,917 popular AI models ran on TorchTPU without crashing. The speech company Deepgram says its own benchmark found Amazon’s chips handled about 60% more audio per dollar than its previous GPU setup. Both tools are early — Amazon’s is a test version — and both companies mostly rent these chips through their own clouds. Google itself plans to offer as many as 960,000 of Nvidia’s newest chips.

Meta came back to the frontier, and priced it at $50

The Batch on 23 October reports Meta releasing three multimodal models in one week. Muse Wonder Full, the top of the line, is available only to Muse Code subscribers at $50 per month — it ties for second on Artificial Analysis’ Intelligence Index at 56, two points behind Claude Opus 5.5 and identical with Claude Sonnet 5.5. Muse Wonder, the API sibling, scores 52 at $4/$20 per million input/output tokens. And Muse Spark Open is the open one: a mixture-of-experts transformer, 816 billion parameters with 42 billion active per token across 256 experts, scoring 39 — the top open-weights model from any US company, ahead of Mistral Large 4 and Reflection’s Beam, level with DeepSeek-V4.1-Flash, still behind MiMo-V2.6-Pro and GLM-5.3. The licence allows commercial use up to $20 million of revenue and requires products to display “Built with Muse Spark Open”. The model card, The Batch notes, reveals very little about architecture or training.

Reflection’s Beam is slower on the index and faster in the real world

The Batch also covers Beam, the first model from Nvidia-backed Reflection AI: 501 billion parameters, 23 billion active per token, Apache 2.0 weights, $0.70/$2.10 per million tokens. On the Intelligence Index it scores 30 — second among US open-weights models behind Muse Spark Open, and behind several Chinese models. The interesting numbers are elsewhere. Beam used around 26,000 output tokens per task, the fewest of any open-weights model in the comparison, runs at 228 tokens per second, and posts a time-per-task of 1.4 minutes — the fastest Artificial Analysis has measured. At four-bit precision it needs about 300GB, so it runs on four H100s. Reflection was valued at $25 billion in March, has partnered with the Pentagon and the Department of Energy, and Nvidia — already in for $800 million — is reported to be in talks to invest more, acqui-hire, license, or buy it outright.

Your pilot is unpaid implementation

The sharpest GTM piece in my inbox was Adam Jay and Dale’s GTM Uncensored on 25 October, and it describes something I see constantly in agentic AI deals. Their definition: a pilot becomes an unpaid implementation when delivery starts before the buyer agrees how the test ends. Three gaps create false momentum — the CRM stores a pilot end date but not the acceptance rule attached to it; delivery begins to protect the relationship, so the buyer receives work while the purchase stays optional; and a passed test triggers another meeting instead of a signed commercial step.

They price it. An illustrative six-week pilot at six internal hours per week, at a $150 loaded hourly cost, is 36 hours and $5,400 — against a $60,000 first-year contract, 9% of year-one revenue consumed before any commitment. Their four decisions before kickoff: define proof (metric, baseline, source, threshold), name the buyer decision (approver, meeting date, attendees), lock the commercial next step triggered by acceptance, and cap scope and cost with a weekly hours review. Their test is a two-by-two: proof clear and path clear means staff it; proof clear and path missing means remove it from commit; proof missing and path clear means narrow the scope; both missing means “free delivery — price the work, pause, or stop.”

Quick hits

• Andrew Ng’s four Ps for AI-native engineering teams. In the same 23 October Batch: People (budget and space for individuals to get proficient; leaders should build things themselves — “you can’t know what it feels like to ride a bicycle just by watching”), Projects (back a handful top-down, and include growth ideas, not only cost savings), Platforms (make repositories, design decisions and support tickets accessible to agents; build sandboxes and reusable agent skills), Processes (the cost of building to a clear spec has collapsed, so everything else is now the bottleneck — form high-context, high-empowerment teams).
• ChatGPT for Teens rated “Unacceptable Risk”. The Batch reports Common Sense Media’s Youth AI Safety Institute ran more than 4,000 prompts on teen-registered accounts. Hotline mentions on suicide and self-harm prompts fell from 88% to 77% after launch; on prompts indicating depression they fell from 63% to 3%; on substance use they rose from 4% to 58%. Study Mode frequently offered a “show me the answer” button that produced a finished assignment. OpenAI disputes the findings and has asked for a retest with fully activated accounts.
• A 0.2-billion-parameter robot model beat an 8.3-billion one. Researchers at Huazhong University built TurboVLA, which drops the LLM from the vision-language-action stack in favour of separate encoders plus cross-attention. On LIBERO it succeeded 97.6% of the time with 0.2B parameters, 31.2ms latency and 0.9GB of VRAM — against CogVLA’s 97.4% with 8.3B parameters, 115.5ms and 16.1GB.
• 4,000 calls in one day doubled a team’s meeting rate. Kevin Dorsey, CRO at LeanScaper, on RevGenius (24 October): quota attainment is falling while AI use climbs, because leaders hand work to AI before they know what good looks like. His SDR leaders spent one day analysing 4,000+ calls and conversation-to-meeting rate doubled within 60 days. His rule: “If you do not know how to do it well manually, you should not be using AI to do it.” And his best question: “Why on earth were the first things we decided to do with AI, AI SDRs?”
• Our own agent reported a quiet week — and one thing waiting on a human. The Veehive Mind weekly alert for 19–25 October: nothing published, and one campaign sitting in the approval queue that will not go out until a person reviews it. I am including it because the boring line is the point — the agent did not publish, and it told me exactly who was blocking and why.

The theme of the week

Three of this week’s stories are the same story told at different altitudes. Rented models found a critical flaw under two-thirds of the web. A banned model company raised fifteen billion dollars and gave its inference stack away. Two hyperscalers spent real engineering effort making it cheaper to leave the chip vendor everyone said was unleavable. Every one of those is a layer becoming interchangeable.

Which puts a sharper edge on “rent the model, own the harness” than I have had before. The argument used to be about leverage — don’t over-commit to a supplier. This week it is about something closer to identity. If the model is a commodity, the chip is becoming a commodity, and the inference software is being open-sourced by the people who built it, then the only part of your AI system that is yours is the part nobody else can build: what your organisation knows, how you have taught it to be used, what you count as a correct answer, what you refuse to allow, and the record that proves which of those held. Everything else is a line item you can change on a Tuesday.

The corollary is uncomfortable. If you have spent the last year choosing models and nothing else, you have been optimising the layer that is falling in price and rising in supply, while the layer that would have compounded sat untouched.

What this means if you’re deploying agentic AI

• Answer the PHP question today. Which of your internet-facing systems run PHP 8.1 or older, which agents hold credentials that reach them, and how long does revocation take? If any of those takes more than an hour to answer, that gap is your real exposure — not the CVE.
• Build a model provenance record. The DHS order covers products “developed using DeepSeek implementations”. Record, per agent, which models touched it — including vendor fine-tunes and anything used in distillation — so the next order is a config change, not an investigation.
• Put portability in the contract while vendors are advertising it. TorchNeuron and TorchTPU make the ask credible. Specify a tested exit: how many days to move the workload, who validates it, and who pays for the migration.
• Evaluate on tokens-per-task and time-per-task, not index position. Beam’s 26,000 tokens and 1.4-minute task time matter more in an agentic loop than its index score of 30. Run your own suite on your own tasks before you believe any leaderboard.
• Read every open-weights licence for a revenue ceiling. Muse Spark Open caps commercial use at $20 million of revenue and requires attribution. Flag it before engineering builds a dependency on it.
• Price the context work in your pilots. Define the acceptance threshold, name the approver, set the decision date, and lock the commercial next step — before the first integration call, not after.
• Define what good looks like before you automate it. Dorsey’s rule is the right gate for agent deployment: if your team cannot do the task well manually, you cannot judge whether the agent’s output is any good, and you have no basis for an evaluation.

Frequently asked questions

---

From Veehive Labs

Eleven weeks in, and this week the sentence barely needed defending: rent the model, the compute and the chips; own the context, the harness, the evaluation, the controls and the record of truth. A commodity model found a fourteen-year-old flaw under two-thirds of the web. A banned lab raised fifteen billion dollars and open-sourced its inference stack. Two hyperscalers paid engineers to make leaving the chip incumbent easier. Three different layers, all moving the same way — towards interchangeable — and none of them is the layer that decides whether your agents are trustworthy on Monday. Veehive Labs is a Dubai-based AI innovation lab and custom AI product development company, building model-independent enterprise AI harnesses, custom agents, RAG pipelines and sovereign, private-AI deployments for regulated and operationally complex organisations across the UAE, KSA, GCC and beyond.

If you’re moving from AI strategy to production, start with a focused AI Discovery Sprint — we map your use case, data, systems, agent inventory, model provenance, permissions model, cost ceilings, risks and delivery architecture before the build begins.

• Read the deep dive: Own the harness, rent the model
• Read the last edition: CoreWeave default odds near 60%, Replit swaps its default model
• Explore Veehive Labs enterprise AI services · See our solutions

Agentic AI This Week is written by Sathish Jeyakumar, Founder & CEO of Veehive. Bring your preferred model — we make it understand, speak and operate like your organisation.

← All insights