Published on LinkedIn and amitabhapte.com  |  25 October 2026

Key developments and opinions which caught my attention this week.

This Is What I Read This Week

The story of the week started with a patch. AI tools found two flaws in PHP, the language behind roughly 70% of websites, that had sat unnoticed in the code for more than a decade. The flaws, now called PHP2Shell, allow remote takeover of an unpatched server. PHP shipped fixes on 21 October, and security agencies told anyone who couldn’t patch to take their sites offline. Many did. The Dutch cyber security centre pulled its own public sites, the Port of Rotterdam went dark, and France’s Interior Ministry put every website into maintenance. The tech giants’ response showed both sides of AI in security. Google’s Wiz used AI models to find the flaws, and OpenAI spent about two months coordinating a coalition to prepare fixes. Amazon’s threat team still spotted exploitation attempts before the public disclosure.

Trust was also the theme on Etsy, which banned AI-generated recipes and patterns. Sewing patterns, crochet instructions and other how-to downloads made by AI are out, along with listings built entirely by bots. Every listing now needs at least one unedited photo of the real item. AI art stays, with disclosure. Etsy says buyers’ uncertainty about AI content is a top-three barrier to shopping more.

On distribution, OpenAI is bringing its models to Google Cloud. Its latest models and Codex will sit in Google’s Model Garden, and customers can pay with their existing cloud commitments. OpenAI’s exclusive deal with Microsoft ended in April, and it is already on AWS. Meanwhile, Anthropic launched Claude Duet, an agent that reaches out before you ask. It sends a morning brief, checks your connected apps every few hours, and asks for approval before it sends messages, makes payments, signs documents or deletes files. It is a US-only research preview for now.

And the hardware kept moving. Apple’s first foldable, the iPhone Duo, costs $1,999 and sold out on preorder. Reviewers praised the hinge and the screen, but many apps aren’t yet optimised for it, and some suggest waiting for the second generation.

So What? My PoV and Takeaway This Weekend

This week showed AI as both the lock-picker and the locksmith. Machines found flaws that humans missed for ten years, and attackers were probing them before most of us had heard the name. The time between discovery and exploitation is collapsing. Annual penetration tests and quarterly patch cycles belong to a slower world. If AI can read every line of the code we depend on, we have to assume someone else’s AI is reading it too.

Etsy drew a line I think will spread. AI is welcome where it helps people create, and banned where people rely on its output to work: a recipe that has to cook, a pattern that has to fit. That distinction, between creative content and functional content, applies to every brand that publishes instructions, specifications or advice. If a customer acts on it, a human should have tested it.

My takeaways this week. Measure patch speed in hours and days, and know where your legacy code lives, including the websites your marketing agencies built years ago. Write a simple rule for AI-generated content that customers will act on: tested by a person, or not published. And as models arrive on every major cloud, choose on governance and fit, because access is no longer the differentiator.

The question I’m taking into next week: if AI can find a decade of hidden flaws in a few weeks, what is it about to find in ours?

Published on LinkedIn and amitabhapte.com  |  20 September 2026

Key developments and opinions which caught my attention this week

Google confirmed that Gemini accessed three private systems without permission during a May cybersecurity test, guessing passwords into one and using exposed credentials for the other two. Google found out in July. The public found out in September, when the Wall Street Journal asked. OpenAI published six structured reports concerning model behaviour this week, the first time any lab has done this in a recurring public format. And Reuters reported that Anthropic is considering a new frontier model release ahead of its IPO, a week after Dario Amodei called publicly for the industry to slow down. Both things can be true at once.

At Dreamforce, enterprise buyers on the floor said something different to what was being debated on stage. Last year’s models are enough for most of what they need. Jensen Huang told labs to “run as fast as you can.” The floor voted with their procurement decisions. Palantir’s Alex Karp argued that civil and criminal liability, not regulation, is the right first line of defence. Build something that causes harm, face consequences. 

Meanwhile Meta’s Muse became the No. 1 free iPhone app in the US ten days after launch. Users report $3,500 in car insurance savings, cancelled fraudulent subscriptions, airline refunds, all secured by an agent acting on their behalf. Muse can now make phone calls for you. AI agents are in people’s lives at real scale, right now.

So What – My Takeaway this weekend

The frontier labs are moving faster than the governance structures around them. Enterprise buyers are moving slower than the labs assume. And personal AI agents are already acting in the real world faster than either. These three speeds are not in sync, and the gap between them is growing.

The questions worth asking inside our own organisations right now: what access are we giving our agents, and what can they do without human review? Are our security policies current for a world where AI can find its way into systems through exposed credentials? Are our partners and suppliers held to the same standard?

The industry-level governance debate is welcome and necessary. It does not do the internal work for us. That part is ours to build.