AI, three at a time · read · watch · listen
3 reads

PHP2Shell shows the old protections failing: a roughly ten-week embargo broke on a single Hacker News post. 1Password and Meta's orchestrator are the two places the replacement is being built, one keeping credentials out of the model's hands and the other keeping routing there.

The Wall Street Journal 2026-10-23-1

AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk

PHP2Shell had a patch ready and the exposure still sits with the long tail of unpatched PHP servers. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post. A patch of close to 200 files now doubles as a blueprint, so time-to-deploy is measured in hours.

# tags
ai-cybersecuritycybersecuritypatch-velocityopen-sourcevulnerability-managementresponsible-disclosureopenaisupply-chain-securitywsjai-arms-race
◆ entities
Systemic riskAI safetyOpen Source StrategyAgent governanceVerification Infrastructure
→ threads
ai-cybersecuritysupply-chain-security
⟷ links
2026-05-22-32026-03-09-32026-04-01-32026-04-05-12026-03-11-22026-04-22-22026-05-02-32026-05-01-w32026-05-01-w12026-05-22-w2
permalink
The Wall Street Journal 2026-10-23-2

1Password Surpasses $500 Million in Revenue as AI Agents Drive Growth

1Password passed $500M in ARR from $400M in November 2025, with net new ARR up 90% year over year in Q3, and its CEO says the agent found standing credentials in every incident. 1Password for Agents launches Thursday so personal agents can use credentials without seeing or storing them. After the PHP2Shell race, that control looks like a necessity. Short-lived, platform-issued credentials could eventually shrink the vault market itself.

# tags
agent-securityagent-identitynon-human-identitiesai-securityenterprise-ai-security-postureagentic-aiwsjipo-supply-wavevendor-claims
◆ entities
Agent identityBlast RadiusVendor concentrationAgent governanceEnterprise AI security posture
→ threads
ai-securityipo-supply-wave
⟷ links
2026-05-22-w32026-05-01-w22026-03-20-w32026-05-04-22026-04-20-32026-05-01-w32026-04-20-22026-04-09-22026-03-22-3
permalink
Meta Engineering 2026-10-23-3

The Thin Orchestrator: How We Made Our AI Agents More Reliable by Giving the Router Less to Do

Meta's orchestrator is 1,300 lines, routes 20+ workflows to 14 subagents and does no domain work; only step 6 of its fixed 7-step protocol involves an LLM. A single agent hit 70-80% success with per-task manual prompts and 10-20% without, and column config prep fell from 3-4 days to under an hour (self-reported). It is the same move as 1Password's, applied to routing: the model gets isolated context to be creative in, and nothing deterministic is left for it to hallucinate.

# tags
multi-agent-orchestrationagent-architectureagent-orchestrationcontext-managemententerprise-ai-reliabilitymetaproduction-readinessharness
◆ entities
Harness-as-moatContext managementMulti-agent orchestrationProduction-readinessAgentic AI viability
→ threads
agent-orchestrationenterprise-ai-reliability
⟷ links
2026-03-13-w32026-04-05-12026-05-01-w32026-03-17-12026-05-01-w22026-03-30-32026-04-09-22026-04-15-12026-04-20-3
permalink