AI, three at a time · read · watch · listen
3 reads

Apollo finds the S&P 493 flat while token spend climbs only at VC-backed companies, Meta is routing Muse revenue through advertisers it already owns, and universities may end up certifying the one input a calculator can't supply. Payoff sits with whoever holds the scarce piece, and everyone else is still waiting on diffusion.

Apollo Global Management — The Daily Spark 2026-10-25-1

No Signs of AI Payoff Outside the Tech Sector

Real revenue per worker and profit margins are rising for the Mag 7 and flat for the S&P 493, and the San Francisco Fed's utilization-adjusted TFP shows no AI lift. Because the Mag 7 build and sell the technology, their results can't test whether buyers gain; the 493 can, and Slok's 'great calculator' framing explains why judgment doesn't get cheaper with tokens. The only series still climbing is token spend at VC-backed companies.

Investor's Business Daily (YouTube) 2026-10-25-2

Meta's $1,000 Bull Case: How Muse AI Changes The Valuation Game | IBD

Walmsley calls Muse an offensive bet and orders the money: subscriptions, then business agents in WhatsApp and Messenger ads, then an enterprise API, with consumer agent revenue in 2028 or 2029. Amazon has already blocked Muse on its storefront, so the near-term revenue that doesn't depend on the consumer agent comes through advertisers, where Meta already owns the relationship. Against Apollo's flat 493, this is intelligence paired with an owned counterparty and glasses context.

The Wall Street Journal 2026-10-25-3

AI Splits the American University in Two

Masko argues AI splits the university in two, and a study of 25,000 Chinese students shows why: homework scores rose with AI, then exam scores dropped significantly once the technology was removed. His fix is supervised, AI-free undergraduate assessment. Next to Apollo's 'great calculator', that makes unaided judgment the scarce input; my extension, not his, is that employers could then price a bachelor's that proves it separately from a research degree that proves amplification.

Finding Flaws Got Cheap, So Fixing Them Now Sets the Release Calendar

Postgres 19 slipped from late September or early October to about November 19 because AI review found defects faster than anyone could absorb them. The list was roughly 40 reports averaging a three-line fix, and the fix was never the expensive part: triage, patch, review, commit and backpatch overhead is paid per defect. Grant writing runs the same arithmetic one layer over. A researcher who cut a day a week of proposal work to 45 minutes still loses most rounds once rivals do the same, and fabricated citations in 2.5m biomedical papers rose 12-fold to about 0.5%, so the cost lands on reviewers. PHP2Shell adds the clock: a roughly ten-week embargo broke on one Hacker News post, and a patch of close to 200 files now doubles as a blueprint. Detection scales with compute, while remediation and review scale with maintainers and reading time, and release dates are quietly being set by the second number. Teams that fund the fixing, verifying and absorbing side tend to keep their dates; the ones that bought only the finder inherit a PG20-sized backlog.

The 3 reads that mattered most
The Register · 2026-10-17 2026-10-23-w1

Postgres 19 delayed after AI reviewers find more bugs than humans can fix

Postgres is the week's cleanest measurement of what cheap detection costs downstream. GA moved to about November 19, 2026 and 8 to 10 significant features went back to PG20, after LLM-assisted review produced about 40 reports averaging a three-line fix. The quality bar rose after the features were written and committed, so finished work became work in doubt. Grant review and PHP's patch race follow the same pattern with different people absorbing the load. Watch PG20, which was expected to be bug-fix-only and now carries the leftovers; a verifier only pays off if remediation capacity grows to match.

The Economist · 2026-10-20 2026-10-23-w2

AI and scientific paperwork: productivity boon or slop flood

Grants are the version of this problem with no checker at all, which is why the Economist piece matters beside the code stories. A typical application takes about 34 days and succeeds about 20% of the time, so a researcher cutting a day a week to 45 minutes still loses most rounds once rivals do the same. Fabricated citations in 2.5m biomedical papers rose 12-fold to about 0.5%, and ICML submissions doubled to 24,000, with the cost landing on reviewers. Where Postgres has committers and PHP has maintainers, science has reader attention, and no mechanical test to ration it. Triage and digest agents start to look less like conveniences and more like core infrastructure.

The Wall Street Journal · 2026-10-23 2026-10-23-w3

AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk

PHP2Shell puts a clock on the week's argument. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post, and a patch of close to 200 files now works as a blueprint. Finding was cheap for the researcher and the attacker alike; absorbing the fix across the long tail of unpatched servers is the slow part. For internet-facing open source, time-to-deploy is measured in hours, so mitigations have to ship before the diff does.

3 reads

PHP2Shell shows the old protections failing: a roughly ten-week embargo broke on a single Hacker News post. 1Password and Meta's orchestrator are the two places the replacement is being built, one keeping credentials out of the model's hands and the other keeping routing there.

The Wall Street Journal 2026-10-23-1

AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk

PHP2Shell had a patch ready and the exposure still sits with the long tail of unpatched PHP servers. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post. A patch of close to 200 files now doubles as a blueprint, so time-to-deploy is measured in hours.

The Wall Street Journal 2026-10-23-2

1Password Surpasses $500 Million in Revenue as AI Agents Drive Growth

1Password passed $500M in ARR from $400M in November 2025, with net new ARR up 90% year over year in Q3, and its CEO says the agent found standing credentials in every incident. 1Password for Agents launches Thursday so personal agents can use credentials without seeing or storing them. After the PHP2Shell race, that control looks like a necessity. Short-lived, platform-issued credentials could eventually shrink the vault market itself.

Meta Engineering 2026-10-23-3

The Thin Orchestrator: How We Made Our AI Agents More Reliable by Giving the Router Less to Do

Meta's orchestrator is 1,300 lines, routes 20+ workflows to 14 subagents and does no domain work; only step 6 of its fixed 7-step protocol involves an LLM. A single agent hit 70-80% success with per-task manual prompts and 10-20% without, and column config prep fell from 3-4 days to under an hour (self-reported). It is the same move as 1Password's, applied to routing: the model gets isolated context to be creative in, and nothing deterministic is left for it to hallucinate.