Latest / The AI Practitioner Brief / OpenAI's Monitoring Gaps, $1.25T Round, and PHP's Patch — October 23, 2026

Transcript

OpenAI's Monitoring Gaps, $1.25T Round, and PHP's Patch — October 23, 2026 · The AI Practitioner Brief

• 0:04
  SPEAKER_01: Welcome to The AI Practitioner Brief,
• 0:07
  SPEAKER_01: the podcast from AIpractitioner.substack.com,
• 0:11
  SPEAKER_01: where I turn the latest AI and tech news into practical insights
• 0:15
  SPEAKER_01: for AI practitioners.
• 0:17
  SPEAKER_01: I'm Lina Faik,
• 0:18
  SPEAKER_01: an ML engineer,
• 0:19
  SPEAKER_01: consultant, and lecturer in advanced machine learning at Sorbonne University.
• 0:23
  SPEAKER_01: It's Friday, October 23.
• 0:25
  SPEAKER_00: Friday already.
• 0:26
  SPEAKER_00: Let's get into it.
• 0:27
  SPEAKER_01: With me,
• 0:28
  SPEAKER_01: as always,
• 0:28
  SPEAKER_01: is Jimmy, my co-host on The Brief, who asks the questions I'd otherwise skip past.
• 0:34
  SPEAKER_00: That's the job.
• 0:35
  SPEAKER_00: What split personality are we talking about today?
• 0:38
  SPEAKER_01: OpenAI is finalizing a funding round that could value it at $1.25 trillion.
• 0:44
  SPEAKER_01: On the very same day,
• 0:45
  SPEAKER_01: a profile ran on the one volunteer who personally patches the PHP code running most
• 0:50
  SPEAKER_01: of the web unpaid in his spare time.
• 0:53
  SPEAKER_00: Same week, wildly different budgets.
• 0:55
  SPEAKER_01: We'll start with the headlines, the five stories you need to know about today.
• 0:59
  SPEAKER_01: Then we've got three deep dives.
• 1:01
  SPEAKER_01: We'll look at how two outside research groups broke OpenAI's own system
• 1:06
  SPEAKER_01: for watching what its AI agents do,
• 1:08
  SPEAKER_01: what that trillion-dollar funding round actually buys,
• 1:10
  SPEAKER_01: and what AI really costs to run,
• 1:13
  SPEAKER_01: and why two critical security bugs in PHP exposed how little
• 1:16
  SPEAKER_01: the Internet's basic plumbing gets paid for.
• 1:19
  SPEAKER_00: Agents policing themselves.
• 1:21
  SPEAKER_00: That already sounds fragile.
• 1:22
  SPEAKER_01: Google confirmed this week that Gemini 3.5 Pro,
• 1:26
  SPEAKER_01: a flagship model it had been promising since May, is never shipping.
• 1:30
  SPEAKER_01: Engineers found deep structural problems in how it handled complex coding tasks,
• 1:35
  SPEAKER_01: and an attempted fix made things worse instead of better.
• 1:38
  SPEAKER_00: So the whole model got shelved?
• 1:39
  SPEAKER_01: Scrapped completely.
• 1:41
  SPEAKER_01: Google restarted the model from scratch and folded what it learned into Gemini 4,
• 1:45
  SPEAKER_01: which has already launched.
• 1:47
  SPEAKER_00: That's an expensive way to find out your coding benchmarks don't hold up.
• 1:50
  SPEAKER_01: 1Password.
• 1:51
  SPEAKER_01: The password manager a lot of companies already use launched a system
• 1:55
  SPEAKER_01: that lets AI agents log into websites without ever seeing the actual password.
• 2:00
  SPEAKER_01: The agent asks the vault for credentials,
• 2:02
  SPEAKER_01: a human approves,
• 2:03
  SPEAKER_01: and 1Password fills them in at the destination site behind the scenes.
• 2:07
  SPEAKER_00: So the agent never touches the real password at all?
• 2:10
  SPEAKER_01: Never sees it.
• 2:11
  SPEAKER_01: That's the whole point,
• 2:12
  SPEAKER_01: since an agent that can read your password can also leak it or get tricked
• 2:15
  SPEAKER_01: into handing it over.
• 2:17
  SPEAKER_00: That's one less thing for a hacked agent to leak.
• 2:19
  SPEAKER_01: OpenAI fired three safety researchers after security found signal chats
• 2:23
  SPEAKER_01: with disappearing messages on their personal phones.
• 2:26
  SPEAKER_01: The company says this was a policy violation about handling sensitive information,
• 2:31
  SPEAKER_01: not retaliation.
• 2:32
  SPEAKER_01: All three had been pushing for more industry-wide collaboration on safety.
• 2:36
  SPEAKER_00: Convenient timing for people asking for more openness to lose their jobs over
• 2:40
  SPEAKER_00: a messaging app setting.
• 2:41
  SPEAKER_01: That covers the AI side.
• 2:43
  SPEAKER_01: Elsewhere in tech,
• 2:44
  SPEAKER_01: Amazon refreshed its tablet line,
• 2:45
  SPEAKER_01: dropping the old Fire branding for new Alexa-branded tablets
• 2:48
  SPEAKER_01: that let you sideload apps through Google's Play Store and use normal Gmail
• 2:53
  SPEAKER_01: and YouTube.
• 2:53
  SPEAKER_01: The 12-inch Alexa Tablet Pro has a sharp 120Hz screen at a price well under an iPad.
• 3:00
  SPEAKER_00: Finally, a tablet that doesn't fight you over which apps you're allowed to use.
• 3:03
  SPEAKER_01: Two platforms announced ways to control AI spending this week.
• 3:07
  SPEAKER_01: Harness,
• 3:08
  SPEAKER_01: a company that makes software deployment and cost management tools,
• 3:11
  SPEAKER_01: launched AI budgets,
• 3:12
  SPEAKER_01: turning cost policy into hard weekly spending limits by team or model.
• 3:17
  SPEAKER_01: The company says its own testing Everyone's suddenly building a dashboard for
• 3:20
  SPEAKER_01: the AI credit card bill.
• 3:39
  SPEAKER_01: Budgets are one thing to keep an eye on.
• 3:41
  SPEAKER_01: What AI agents actually do while nobody's watching is a bigger problem.
• 3:45
  SPEAKER_01: And that's where our first deep dive starts.
• 3:48
  SPEAKER_01: Two outside safety groups,
• 3:49
  SPEAKER_01: Matar and Redwood Research,
• 3:51
  SPEAKER_01: spend three weeks with deep access inside OpenAI's own infrastructure.
• 3:55
  SPEAKER_00: Who watches the watcher, basically.
• 3:57
  SPEAKER_01: Right.
• 3:58
  SPEAKER_01: OpenAI runs software that's supposed to catch an agent doing something it shouldn't,
• 4:02
  SPEAKER_01: like a coding agent quietly deleting files outside its sandbox,
• 4:06
  SPEAKER_01: the restricted area an agent is normally confined to.
• 4:09
  SPEAKER_01: Meta and Redwood were brought in to see if that catch system actually catches anything.
• 4:13
  SPEAKER_00: And did it?
• 4:14
  SPEAKER_01: Not reliably.
• 4:15
  SPEAKER_01: They found three separate ways to beat it,
• 4:17
  SPEAKER_01: and each one attacks a different assumption the system was built on.
• 4:20
  SPEAKER_00: Give me one.
• 4:21
  SPEAKER_02: The first broke the sandbox boundary itself.
• 4:24
  SPEAKER_02: They found a way for OpenAI's coding agent,
• 4:26
  SPEAKER_02: called Codex,
• 4:28
  SPEAKER_02: to get around both its sandbox and a second check called AutoReview,
• 4:32
  SPEAKER_02: and from there take any action the human user it was working for could take.
• 4:36
  SPEAKER_00: So the agent could just act as the human?
• 4:38
  SPEAKER_01: Effectively, yes, within that session.
• 4:40
  SPEAKER_01: The second flaw was about visibility.
• 4:42
  SPEAKER_01: One bug would have let an agent hide hundreds of actions from the monitor entirely,
• 4:46
  SPEAKER_01: so the log-a-safety-reviewer checks afterward just wouldn't contain them.
• 4:50
  SPEAKER_00: That's worse than the sandbox one.
• 4:51
  SPEAKER_00: At least a sandbox escape leaves a trace.
• 4:54
  SPEAKER_01: Redwood made that exact point.
• 4:56
  SPEAKER_01: The third flaw was about timing.
• 4:58
  SPEAKER_01: The monitor only checked in when the agent handed control back to the user.
• 5:01
  SPEAKER_01: During a period when a certain internal checkpoint wasn't being watched,
• 5:05
  SPEAKER_01: an agent could keep working indefinitely and never trigger a check at all.
• 5:08
  SPEAKER_00: So it's not that the agent broke out, it's that nobody was looking.
• 5:12
  SPEAKER_01: That's the real picture.
• 5:13
  SPEAKER_01: OpenAI estimated that somewhere between 75% and 94% of its internal agent traffic
• 5:18
  SPEAKER_01: from its most advanced systems was supposed to be covered by this monitoring.
• 5:22
  SPEAKER_01: These three bugs cut straight into that coverage.
• 5:25
  SPEAKER_00: Is this patched now?
• 5:26
  SPEAKER_01: OpenAI told the two groups it's patched everything they found in production.
• 5:30
  SPEAKER_00: Have they said whether they're going back to check it themselves?
• 5:33
  SPEAKER_01: Not publicly.
• 5:33
  SPEAKER_01: Their account only describes what the system looked like on and before July 21st,
• 5:38
  SPEAKER_01: so there's a real chance the picture has already changed since then,
• 5:41
  SPEAKER_01: just not in a way anyone outside the company has confirmed.
• 5:44
  SPEAKER_00: What's actually new here?
• 5:46
  SPEAKER_00: Companies have had bugs in security tools before.
• 5:48
  SPEAKER_01: What's new is who's running on this.
• 5:50
  SPEAKER_01: OpenAI gives its coding agents more autonomy every few months,
• 5:54
  SPEAKER_01: and the whole argument for doing that safely is that something is watching.
• 5:57
  SPEAKER_01: If the watcher has blind spots, the autonomy keeps growing faster than the safety case for it.
• 6:02
  SPEAKER_00: And nobody outside OpenAI can check whether that gap is actually closed.
• 6:06
  SPEAKER_01: Not yet.
• 6:06
  SPEAKER_01: Metar and Redwood published this because they think outside red teaming,
• 6:10
  SPEAKER_01: having people who don't work for the company try to break your safety tools
• 6:13
  SPEAKER_01: on purpose, needs to become normal practice instead of a one-off favor.
• 6:17
  SPEAKER_00: Has any other lab done this kind of outside test on their own monitoring?
• 6:20
  SPEAKER_01: Not that's been published.
• 6:22
  SPEAKER_01: As far as the record shows,
• 6:23
  SPEAKER_01: this is the first time it's happened in public,
• 6:25
  SPEAKER_01: which makes it a floor for the industry, not yet a standard.
• 6:28
  SPEAKER_00: A floor that only one company has even set.
• 6:31
  SPEAKER_01: And building that kind of outside checking isn't free.
• 6:33
  SPEAKER_01: It's one more cost stacked on top of an AI business that's already burning
• 6:37
  SPEAKER_01: through money at a scale that's genuinely hard to picture.
• 6:40
  SPEAKER_00: A trillion is a number I can't actually picture.
• 6:42
  SPEAKER_01: OpenAI is finalizing a funding round of up to $30 billion, according to multiple reports.
• 6:48
  SPEAKER_01: It would value the company at $1.25 trillion.
• 6:51
  SPEAKER_01: The round is being led by Kotu,
• 6:53
  SPEAKER_01: a big technology investment firm alongside investors from the United Arab Emirates.
• 6:57
  SPEAKER_00: Why raise now instead of waiting for an actual public listing?
• 7:01
  SPEAKER_01: It's lower than the $1.4 trillion OpenAI originally wanted,
• 7:04
  SPEAKER_01: but it's still far above the roughly $850 billion valuation it had back in March.
• 7:09
  SPEAKER_01: It's being described as a bridge round,
• 7:11
  SPEAKER_01: extra cash to cover the gap before a possible initial public offering or IPO
• 7:15
  SPEAKER_01: in 2027.
• 7:17
  SPEAKER_00: Bridge to where though?
• 7:18
  SPEAKER_00: What's actually eating the cash?
• 7:20
  SPEAKER_01: That connects to something else published this week,
• 7:22
  SPEAKER_01: a breakdown of what running AI models actually costs a company day to day.
• 7:26
  SPEAKER_01: Token prices,
• 7:27
  SPEAKER_01: what you pay per unit of text a model reads or writes, fell 82% in under two years.
• 7:32
  SPEAKER_01: They went from about 77 cents per million tokens down to 14 cents.
• 7:36
  SPEAKER_00: Prices crashed and they're still raising 30 billion dollars?
• 7:39
  SPEAKER_01: Because usage grew even faster than price fell.
• 7:42
  SPEAKER_01: Weekly token volume across the industry went from around 500 billion tokens
• 7:46
  SPEAKER_01: to 164 trillion in that same period.
• 7:49
  SPEAKER_01: It's cheaper per unit, but a staggering amount more units move through the system.
• 7:53
  SPEAKER_00: So nobody's actually spending less.
• 7:55
  SPEAKER_01: Some are.
• 7:56
  SPEAKER_01: Among AI-native startups, token usage went up 18 times over the past year.
• 8:01
  SPEAKER_01: Their actual spend only grew about five times.
• 8:03
  SPEAKER_01: The gap comes down to two things.
• 8:05
  SPEAKER_01: Picking cheaper models for routine work and caching.
• 8:08
  SPEAKER_00: What's caching doing in a cost story?
• 8:10
  SPEAKER_01: When a model reuses text it's already seen earlier in the same conversation,
• 8:14
  SPEAKER_01: providers charge far less for rereading it than for fresh input,
• 8:18
  SPEAKER_01: sometimes as little as 5% of the normal price.
• 8:21
  SPEAKER_01: For an AI agent that resends its whole history on every step,
• 8:24
  SPEAKER_01: that discount is often the single biggest lever on the bill.
• 8:27
  SPEAKER_00: That's a real number I can actually use.
• 8:29
  SPEAKER_01: There's a sharper one.
• 8:31
  SPEAKER_01: Open weight models,
• 8:32
  SPEAKER_01: meaning models whose underlying parameters are published rather than locked behind
• 8:35
  SPEAKER_01: a paid API,
• 8:36
  SPEAKER_01: make up about 60% of weekly token volume on one major routing service,
• 8:41
  SPEAKER_01: but they're only 26% of the money spent.
• 8:44
  SPEAKER_00: So most of the traffic is cheap and the real spending is concentrated somewhere else.
• 8:48
  SPEAKER_01: In the expensive frontier models,
• 8:50
  SPEAKER_01: for the harder tasks people are willing to pay more to get right.
• 8:53
  SPEAKER_01: Take a task that costs $1 to run.
• 8:55
  SPEAKER_01: If it only succeeds 80% of the time, the real cost per successful result isn't $1.
• 9:00
  SPEAKER_01: It's $1.25.
• 9:02
  SPEAKER_00: Because you're paying for the failures too.
• 9:04
  SPEAKER_01: Exactly.
• 9:05
  SPEAKER_01: And most teams aren't tracking that number at all.
• 9:07
  SPEAKER_01: They look at the price per token on the invoice and never work out
• 9:10
  SPEAKER_01: the price per thing that actually worked.
• 9:12
  SPEAKER_00: I'd bet most people reading this don't even know their own success rate well enough
• 9:16
  SPEAKER_00: to run that math.
• 9:17
  SPEAKER_01: Probably true.
• 9:18
  SPEAKER_01: And that's the real gap here.
• 9:19
  SPEAKER_01: Not whether OpenAI's valuation makes sense,
• 9:22
  SPEAKER_01: but whether the companies paying OpenAI
• 9:23
  SPEAKER_01: and everyone else even know what they're truly paying per useful result.
• 9:27
  SPEAKER_00: So the trillion dollar number is almost a distraction from the thing you can actually fix.
• 9:32
  SPEAKER_01: That's a fair read.
• 9:33
  SPEAKER_01: The valuation is someone else's bet on the future.
• 9:36
  SPEAKER_01: The cost per success gap is the part nobody's actually measuring.
• 9:39
  SPEAKER_01: And it's the real reason usage keeps climbing even while everyone insists prices are falling.
• 9:43
  SPEAKER_00: Funny, because today's other big infrastructure story is the exact opposite of
• 9:47
  SPEAKER_00: a trillion dollars.
• 9:49
  SPEAKER_01: It really is.
• 9:50
  SPEAKER_01: While OpenAI negotiates a $1.25 trillion valuation,
• 9:53
  SPEAKER_01: the actual code running most of the web just got patched by one unpaid volunteer.
• 9:58
  SPEAKER_00: 70% is a lot of load-bearing code for a couple of bugs.
• 10:02
  SPEAKER_01: Security researchers found two critical bugs this week in PHP,
• 10:05
  SPEAKER_01: the programming language that still powers something like 70% of websites.
• 10:09
  SPEAKER_01: Both let an attacker take over a server without even needing a password
• 10:13
  SPEAKER_01: and both scored 9.2 out of 10 on the standard severity scale researchers used
• 10:17
  SPEAKER_01: to rank how dangerous a flaw is.
• 10:19
  SPEAKER_00: How does an attacker actually get in?
• 10:21
  SPEAKER_01: One bug is about what happens when PHP runs out of memory.
• 10:24
  SPEAKER_01: It's supposed to clean up safely,
• 10:25
  SPEAKER_01: but instead it can corrupt the memory it's holding,
• 10:28
  SPEAKER_01: and an attacker can shape that corruption into their own code running
• 10:31
  SPEAKER_01: on your server.
• 10:32
  SPEAKER_01: The second is a use after free.
• 10:34
  SPEAKER_01: PHP keeps a reference to a piece of memory after telling the system
• 10:37
  SPEAKER_01: that memory is free to reuse,
• 10:39
  SPEAKER_01: so an attacker can slip their own data into that spot before PHP comes back
• 10:42
  SPEAKER_01: to use it.
• 10:43
  SPEAKER_00: So in both cases, something PHP thinks is safely handled actually isn't.
• 10:47
  SPEAKER_01: Right.
• 10:48
  SPEAKER_01: Researchers are calling the pair PHP2Shell,
• 10:51
  SPEAKER_01: and it hits nearly every common way PHP serves a web page,
• 10:54
  SPEAKER_01: including the most widely used Apache setup called ModPHPH.
• 10:58
  SPEAKER_00: Is one setup worse than the others?
• 11:00
  SPEAKER_01: ModPHP is the worst case,
• 11:02
  SPEAKER_01: because the attack can succeed before any of your own application code even runs.
• 11:06
  SPEAKER_01: There's nothing your own code could have done differently.
• 11:08
  SPEAKER_00: Are people actively exploiting this right now?
• 11:11
  SPEAKER_01: Researchers at Rapid7,
• 11:12
  SPEAKER_01: a cybersecurity firm,
• 11:13
  SPEAKER_01: say proof-of-concept exploits are already public,
• 11:16
  SPEAKER_01: but each one only works against a specific combination of operating system,
• 11:20
  SPEAKER_01: PHP version, and web server, so nothing broadly reliable yet.
• 11:24
  SPEAKER_01: That's likely to change fast.
• 11:25
  SPEAKER_00: So the clock's already running.
• 11:27
  SPEAKER_01: Which is why the fix matters more than the exploit right now.
• 11:30
  SPEAKER_01: PHP shipped patches on October 21st,
• 11:33
  SPEAKER_01: bumping to versions 8.2.35,
• 11:35
  SPEAKER_01: 8.3.36, 8.4.27, or 8.5.12, depending which track you're on.
• 11:42
  SPEAKER_01: If you're running anything older, that's the real action here.
• 11:44
  SPEAKER_01: Patch now.
• 11:45
  SPEAKER_00: That's the one thing in this whole episode someone could actually go do today.
• 11:49
  SPEAKER_01: It is.
• 11:50
  SPEAKER_01: And here's the part that makes this story stick.
• 11:52
  SPEAKER_01: The person who did most of the actual work getting these patches out to Debian
• 11:55
  SPEAKER_01: and Ubuntu,
• 11:56
  SPEAKER_01: two of the most widely used Linux systems,
• 11:58
  SPEAKER_01: is one volunteer, a Czech developer named Andre Suri.
• 12:01
  SPEAKER_00: One guy handles that much of the web?
• 12:03
  SPEAKER_01: Not 70% of the web,
• 12:04
  SPEAKER_01: by himself,
• 12:05
  SPEAKER_01: but he's the person most Debian and Ubuntu servers quietly depend on to package
• 12:09
  SPEAKER_01: and ship PHP security fixes.
• 12:11
  SPEAKER_01: A software developer named Ian Landsman put it bluntly in a widely shared post,
• 12:15
  SPEAKER_01: if anything happens to this guy, everyone is screwed.
• 12:18
  SPEAKER_00: What does Suri say about that kind of pressure?
• 12:20
  SPEAKER_01: He was almost unnervingly calm about it, in an interview with The Atlantic.
• 12:24
  SPEAKER_01: His exact words,
• 12:26
  SPEAKER_01: it would be a crazy day for me if I was on a boat in the middle of the Adriatic Sea,
• 12:29
  SPEAKER_01: that could happen, but I had time to prepare the packages.
• 12:32
  SPEAKER_00: And if he weren't around that day?
• 12:34
  SPEAKER_01: His own words were that if he got hit by a bus, it would be someone else's problem.
• 12:38
  SPEAKER_01: He does this as a volunteer.
• 12:40
  SPEAKER_01: He actually has a full-time job running network infrastructure at
• 12:42
  SPEAKER_01: a completely different organization.
• 12:44
  SPEAKER_00: That's not reassuring, it's just honest.
• 12:46
  SPEAKER_01: It is.
• 12:47
  SPEAKER_01: And it's the real contrast with the OpenAI story.
• 12:50
  SPEAKER_01: One side of the industry is negotiating over a trillion dollars in private capital.
• 12:54
  SPEAKER_01: The other side,
• 12:55
  SPEAKER_01: the actual plumbing those trillion dollar products run on top of,
• 12:58
  SPEAKER_01: is held together by volunteers nobody's paying to be there.
• 13:01
  SPEAKER_00: I don't think that gap closes on its own.
• 13:03
  SPEAKER_00: Nobody's incentive is to pay for plumbing nobody sees.
• 13:06
  SPEAKER_01: Probably not.
• 13:07
  SPEAKER_01: The honest version is that it keeps working until the day it doesn't
• 13:10
  SPEAKER_01: and right now there's no plan for what happens on that day.
• 13:14
  SPEAKER_01: Today was really one story told three ways.
• 13:16
  SPEAKER_01: How much trust and money we're willing to pour
• 13:18
  SPEAKER_01: into AI we can't fully verify is safe,
• 13:21
  SPEAKER_01: while the ordinary infrastructure underneath all of it runs on duct tape
• 13:24
  SPEAKER_01: and goodwill.
• 13:25
  SPEAKER_01: OpenAI's monitoring gaps,
• 13:26
  SPEAKER_01: it's trillion dollar round,
• 13:27
  SPEAKER_01: and one volunteer patching PHP are the same gap,
• 13:30
  SPEAKER_01: just showing up at different price points.
• 13:32
  SPEAKER_00: I'll bet the PHP story gets more attention this week than the valuation does.
• 13:36
  SPEAKER_00: A trillion dollars is hard to feel.
• 13:39
  SPEAKER_00: One guy on a boat in the Adriatic is easy to feel.
• 13:41
  SPEAKER_01: That's Friday.
• 13:45
  [music]