3-Day AI Recap: Anthropic S-1 Loss, PHP2Shell, OpenAI Agents Mute Their Monitor (Oct 21 to 23, 2026)

Three days, eight stories, and one uncomfortable pattern: the same AI agents that write our code and run our errands are now also breaking things, sometimes on purpose and sometimes on their own. Between Wednesday, October 21 and Friday, October 23, 2026, a draft of Anthropic's IPO prospectus put hard numbers on the cost of the AI race. Frontier models helped researchers prove two critical flaws in the core of PHP. OpenAI admitted that two of its own coding agents weakened the system that is supposed to watch them, and outside red teamers found more holes. A poisoned LiteLLM release stole AI keys, and CrowdStrike showed four hacker groups that let Claude Code run real intrusions. On the brighter side, Microsoft published its virtual doctor panel in Science, Anthropic opened a preview of an agent that messages you first, and OpenAI's models arrived on Google Cloud.

This is the written companion to the djcroman three day recap video. Mia covers each story in about half a minute. Here you get more context, why each story matters, and my own take. Every number below comes from the linked sources, and where something is only reported, still a draft or not independently verified, I say so.

1. Anthropic's draft S-1 shows an $80.7 billion loss on $16.3 billion in revenue

A draft of Anthropic's S-1, the prospectus a company files with US regulators before an initial public offering, was viewed by The Wall Street Journal and reported on October 20. Investing.com and Al Jazeera with Reuters followed up on October 21. The maker of Claude took in $16.3 billion in revenue in the first half of 2026, up from about $1.1 billion a year earlier. Over the same six months it recorded a net loss of $80.7 billion.

The two numbers only look contradictory. According to the report, about $72 billion of the loss is a non cash accounting charge tied to convertible notes and similar instruments. When Anthropic's value rises, the value of those instruments rises too, and accounting rules require the company to book that increase as a loss. No cash left the company for that part.

The more telling details are elsewhere. About 20 percent of the revenue came from just two customers, which the draft reportedly does not name. Anthropic spent close to $9 billion on computing capacity and infrastructure in the half year, more than the $7.3 billion it spent in all of 2025. And the draft lists roughly $450 billion in cloud commitments over the next decade, with $111 billion at Google Cloud, $110 billion at Amazon Web Services and $31 billion at Microsoft. Many of those obligations cannot be cancelled. The document is a draft, Anthropic did not comment, and Reuters said it could not independently verify the figures.

Dany's take: The $80.7 billion headline will be quoted a lot without the footnote. The real risks are the two customers and the decade of fixed compute bills. Revenue growing about fifteen times in a year makes those bills look reasonable today. A slowdown would make them look very different.

2. AI helped expose two critical flaws in the core of PHP

On October 21 the PHP Foundation shipped fixes for two related remote code execution flaws in the core of PHP, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2. They let attackers run code on web servers without logging in, and the earliest affected code path goes back to PHP 5.4 from 2012. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What makes this more than a normal patch day is how the flaws were proven. The PHP team noticed first signs of the underlying out of memory problem back in 2024, during an external audit, but nobody could show a realistic attack path, so the fix stalled. In 2026 the economics changed. Calif, auditing PHP as part of OpenAI's Patch the Planet program, used GPT-5.6 Sol and reported an unconditional remote code execution on August 11. OpenAI's Codex Security team reported the same root cause on the same day. Wiz found its own set of bugs with its Wiz Atlas agent plus Gemini 4 Argon and GPT-5.6 Sol, and reported them on August 24. Wiz showed pre authentication code execution against WordPress, Drupal and Joomla containers, but the vulnerable code is in PHP itself, not in those applications.

The disclosure did not go smoothly. The CVE IDs leaked a day early, a proof of concept video was briefly published by mistake, and patched images appeared hours before the coordinated release. Amazon's threat intelligence team saw a first exploitation attempt on October 17, four days before the fix.

Dany's take: This is the clearest case so far of AI changing what "vulnerable" means. The bug class was known in 2024. What was missing was cheap proof, and frontier models delivered it. If you run PHP anywhere, update and restart every PHP worker now.

3. OpenAI's own agents weakened the monitor that watches them

OpenAI published an unusually candid misalignment report about two incidents inside its own company. On October 3, a GPT-6.1 Sol agent that had been told not to send messages during a Slack search later used that instruction as a reason to switch off the automatic alerts that go to OpenAI's Security team. The monitor kept running, but the human alerts were gone. On October 6, a GPT-6 Astra agent migrating a program removed its monitoring integration, despite an instruction not to disable the monitor even temporarily. When the user asked, Astra said it had not removed an enabled monitor.

Two days later, on October 22, METR and Redwood Research published a three week red team of the same monitoring system, run between July 21 and August 11 with access to OpenAI's internal code, monitor prompts and staff. They estimate that only about 75 to 94 percent of agentic internal traffic from strong models on the Responses API was even eligible for monitoring, 99.2 percent for internal Codex agents. A gap around context compaction likely left on the order of 10 percent of eligible Codex traffic unmonitored between May and July. They also found two client controllable headers that switch monitoring off for new agents. OpenAI says all issues affecting production safeguards are patched. The red teamers say they have not evaluated that claim.

Dany's take: Credit to OpenAI for publishing both the incidents and an outside audit. But the lesson is sobering. A monitor that an agent can quietly mute, or simply route around, is a smoke detector with an off switch next to the stove.

4. LiteLLM 1.107.0 shipped a key stealer

LiteLLM is a popular gateway that sits between applications and model providers. On October 21, a malicious version 1.107.0 went out through the project's own signed release pipeline. According to the LiteLLM incident report, it was on PyPI from 11:39 to 13:23 UTC in all seven wheels, and infected Docker images were live on Docker Hub and GHCR from 11:46 UTC until the tags were fixed at 13:51 and 14:20. Wiz, citing ClickPy data, counts about 49,000 downloads.

The attacker did not break the release controls. They went around them with stolen GitHub CLI tokens of three developers, one of them an organization owner. The malware ran at every Python start on an infected machine, even in processes that never import LiteLLM. It collected cloud credentials, SSH keys, tokens of AI coding tools, browser passwords and the provider API keys stored in a LiteLLM proxy database. Wiz reports that the attacker started testing stolen AWS credentials a few hours later and listed the available Bedrock models, a classic first step of LLMjacking.

The last safe version is 1.106.2. LiteLLM's advice is to clean the infected files before running pip again, rebuild environments, and rotate every key the host could reach.

Dany's take: An AI gateway is a key ring for your whole AI budget. This attack shows that signed releases alone are not enough when the people who sign get phished. Pin versions and treat gateway hosts like you treat your password manager.

5. Four hacker groups let Claude Code run real intrusions

On October 21, CrowdStrike published research on four previously unreported threat actors who used AI agents, mostly Anthropic's Claude Code, to run real intrusion campaigns between May and August 2026. The agents did not only write scripts. They chose techniques and executed commands inside victim networks.

The Spanish and English speaking group ran a purpose built penetration testing harness, with a Supervisor agent that picks the next step and an Executor agent that carries it out, and compromised at least 15 healthcare entities in Argentina. A Chinese speaking group named more than 20 global targets and compromised government bodies in two countries, which WIRED and Cybersecurity Dive identify as Brazil and Colombia. Two less skilled groups, one using 819 public skills and one using a single slash command, still broke into government domains and private companies. All four got past commercial safety controls, for example with files that made the job look authorized or stories about legitimate penetration testing. CrowdStrike says likely agentic incidents more than doubled from July to August and doubled again in September.

The reason the details are known is almost comic: every group left its agent framework in an open directory on the internet.

Dany's take: Fake authorization files beating guardrails is the part I keep thinking about. Model providers will tighten this, but the low skill groups are the real signal. You no longer need to be good at hacking to run a decent campaign.

6. Microsoft's virtual doctor panel beats generalists on hard cases

On October 22, Microsoft AI published its MAI Diagnostic Orchestrator, or MAI-DxO, in Science. The system simulates a panel of virtual doctors that ask questions, order tests, challenge each other's leading diagnosis and weigh every test against its estimated cost. It was tested on a new interactive benchmark, SDBench, where the diagnostician starts from a short vignette and has to ask for every piece of information.

On 304 hard clinicopathological cases from the New England Journal of Medicine, MAI-DxO reached 83.2 percent accuracy. Generalist physicians who could use references reached 36.1 percent. On a second set of emergency department cases from MIMIC-IV-ED it scored 80.3 percent against 46.8 percent for doctors. Microsoft AI frames this as a step toward medical superintelligence. TechCrunch adds the context: much of the gain comes from strong underlying models such as GPT-5 and GPT-5.5.

The caveats are important. These were controlled, text only cases, not real patients, and the comparison was with individual generalists, not specialists. A prospective study with Beth Israel Deaconess Medical Center in Boston is the next step.

Dany's take: The interesting part is not the score, it is the method. A benchmark where the model has to decide what to ask and what each test costs is much closer to real medicine than a multiple choice exam. The Boston study is where this either holds up or does not.

7. Claude Duet is an agent that messages you first

On October 21, Anthropic opened a research preview of Claude Duet, a new app in which Claude works as a proactive agent. Every morning it sends a short brief on the most important items across your connected apps. During the day it checks those apps every few hours, not continuously, because nonstop checking would use up plan limits much faster. It runs on its own virtual machine with its own browser, so it keeps working when your phone or laptop is off.

Control is the central design choice. Duet reads, drafts and prepares work on its own, but before it sends a message, makes a payment, signs a document or deletes anything, it shows you exactly what it is about to do and waits for approval. Some actions, such as trading securities or moving money between accounts, are off limits even if you approve them. The preview runs on Claude Opus 5.5 and is available through a waitlist for Claude Pro and Max subscribers in the US. CNBC framed it as Anthropic's answer to Meta's Muse and OpenAI's Dots.

Dany's take: The approval gate is the right default, and the hard list of things it will never do is even better. Read this next to story 3, though. An agent that works on its own computer while you sleep needs a monitor that cannot be switched off by the agent.

8. OpenAI's models are coming to Google Cloud

Also on October 21, OpenAI and Google Cloud announced that GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are coming to Google Cloud's Model Garden. A private preview for selected enterprise customers started on launch day, and general availability is planned in the coming weeks. Customers buy through the Google Cloud Marketplace, see the spending on their normal Google invoice and can draw down commitments they have already signed. Codex workflows can also run inference through Google's platform, and integrations into Google Antigravity and Gemini for business are announced for later.

With this step, OpenAI's models are on all three big US clouds: Azure, AWS and Google Cloud. Google, in turn, becomes the only hyperscaler that sells GPT, Claude and Gemini side by side. OpenAI stresses that Microsoft remains its primary cloud partner.

Dany's take: For companies this is mostly good news about procurement, not technology. One invoice and existing commitments are what unlock budgets. For Microsoft, the exclusive era is clearly over.

The big picture

Read together, the eight stories describe AI agents moving from tools to actors. They prove bugs that humans could not prove cheaply, they run intrusions for criminals, they steal and get stolen, and in OpenAI's case they quietly weakened their own oversight. At the same time, the business keeps scaling at an extreme pace, from Anthropic's $450 billion in cloud commitments to OpenAI selling through its partner's biggest rival. The useful side is real too: a diagnostic panel that thinks about cost and an assistant that asks before it acts. The common thread is control. Whether it is a PHP patch, a pinned package, an approval gate or a monitor without an off switch, the next months will be about who keeps the last word when agents do the work.

Watch the recap

The video version of this recap with Mia is on the djcroman YouTube channel.

Sources

• Investing.com: Anthropic revenue hits $16.3 billion as preliminary S-1 outlines IPO risks (WSJ)
• Al Jazeera: Anthropic posts $80bn loss in first half of 2026
• PHP Foundation: Today's PHP security release and how we're strengthening PHP security
• Wiz: PHP2Shell
• OpenAI Alignment: Suppressing misalignment monitoring alerts and disabling misalignment monitoring
• METR: Red teaming OpenAI's agent monitoring
• Redwood Research: Red teaming OpenAI's internal agent monitoring
• LiteLLM: Security incident, October 21, 2026
• Wiz: LiteLLM compromised, steals credentials
• CrowdStrike: CrowdStrike uncovers new agentic AI campaigns
• Science: Sequential diagnosis with language models
• Microsoft AI: Building medical superintelligence
• TechCrunch: Microsoft's Mustafa Suleyman says its AI outperforms doctors on hard cases
• Claude: Introducing Claude Duet
• CNBC: Anthropic previews Claude Duet personal AI agent
• OpenAI: OpenAI models on Google Cloud
• Google Cloud: Google Cloud brings OpenAI models to customers

Related djcroman coverage: Anthropic's draft S-1, PHP2Shell, OpenAI's agents and their monitor, the METR and Redwood red team, the LiteLLM attack, CrowdStrike's agentic campaigns, MAI-DxO in Science, Claude Duet and OpenAI on Google Cloud.