AI finds a security hole in 70% of the web
PLUS: Let Town prepare your next meeting brief
Good morning, AI enthusiasts, and welcome to our 15,837 new readers. Just months ago, GPT-5.6 Sol made headlines for hacking Hugging Face. Now, the same model is on the other side of the fence, catching “one of the most impactful security issues in recent memory.”
OpenAI’s last-gen model helped researchers identify two critical flaws in PHP, the code behind about 70% of the web, sending IT teams worldwide into scramble mode — and the company says it has more major security finds like this still waiting to be disclosed.
In today’s AI rundown:
OpenAI’s model helps catch critical PHP flaws
Nate’s Notebook: If it’s copy-paste, let AI do it
Let Town prepare your next meeting brief
Anthropic joins the personal agent game with Duet
LATEST DEVELOPMENTS
OPENAI
Image source: X / The Rundown
The Rundown: PHP, the coding language behind ~70% of websites, just pushed patches for two critical flaws caught with OpenAI’s GPT-5.6 Sol, with the National Security Agency urging anyone who can’t patch right away to pull systems offline.
The details:
Security firm Calif found the first bug on Aug. 1 using 5.6 Sol, and Google-owned Wiz separately caught both weeks later with Sol and Gemini 4 Argon.
OpenAI said it worked on patches alongside the PHP maintainers for two months, calling the find “one of the most impactful security issues in recent memory.”
The decade-old bugs let hackers hijack servers with no login, and OpenAI calls them two of “several significant vulnerabilities” it’s still fixing.
Governments in Finland, Germany, and the Netherlands pulled websites offline, with Cloudflare saying it was “seeing early attacks emerging.”
Why it matters: PHP is used on 70% of websites, making the scale of this vulnerability massive — and yet it wasn’t turned into a working attack until a model now far behind the frontier was pointed at it. Pre-AI code is far more fragile than anyone imagined, and the only hope is that the good guys (and AI) can stay a step ahead of the exploits.
TOGETHER WITH GOOGLE FOR STARTUPS
The Rundown: Google Cloud invites startup founders to an exclusive briefing with the Google DeepMind team to break down the newly announced Gemini 4 Argon model, exploring game-changing use cases and technical enhancements.
In this session, you’ll get:
A technical recap of Argon’s latest capabilities
DeepMind's perspective on high-impact startup use cases
Direct, unfiltered Q&A with the DeepMind team
NATE’S NOTEBOOK
The Rundown: Each week, Rundown AI educator Nate Grahek breaks down what he’s seeing while teaching real teams to use AI.
Nate: If AI still isn’t making you faster, look at where your time goes. You’re searching for the right email, attaching the doc, compiling the context it needs. Then, once the work’s done, you’re copying and pasting everything it made back into the places it belongs.
My rule: if it’s as simple as a copy and paste, AI should be doing it for you through a connector.
Connectors also clear the nice-to-do pile. Everyone has a survey they’ve been meaning to send. It’s the kind of finishing touch that takes good work to great, and the first thing to go when we’re squished.
Hook your AI up to Tally or Jotform, and the whole loop happens without leaving chat: brainstorm the questions, build the form, draft the email to your audience, then pull the responses back in and make sense of them. Not a survey person? Find the finishing touch that lives in one or two tools you could connect today.
I sat on the sidelines over security, too. Now my ladder is read, then write, then send. Surveys are a safe first rung; nothing goes out by accident. Draft and critique everything in chat first. When it touches your inbox, it writes the draft, and you hit send.
Online banking felt risky too, until one day you stopped going to the branch. By next fall, most of us won’t open our inbox first. Our agent will have already triaged it and pitched us a short list of projects to say yes or no to.
Which app would you let your AI read first: inbox, drive, or calendar?
AI TRAINING
The Rundown: In this guide, you’ll use Town, a business-focused personal AI assistant, to turn email and calendar details into a meeting brief. You’ll catch an unconfirmed time change, check the open work, and save the process for reuse.
Step-by-step:
Sign up for Town and connect an approved Google test account. Keep changes behind approval and review any routines already running
Add the guide’s fictional emails and private calendar event. Ask your Townie to read those exact sources and prepare a short brief in the conversation
Check the meeting time, launch date, budget, and open tasks. A request to move a meeting should stay separate from the time still on the calendar
Update the test event and send the confirming email. Ask for a fresh brief and check that only the changed facts move with it
Save the process as a routine that runs only when you choose. Inspect its tools, delivery, and first result before adding a daily schedule
Pro tip: Town’s read-only routines can still email reports to you. Check the recipient and delivery settings as well as the mode. Pro members get the practice emails, prompts, and answer key.
PRESENTED BY VANTA
The Rundown: Competition’s tough for startups, and everyone needs an edge. Nothing kills a deal faster than showing up without a SOC 2, but audit prep takes time most teams don’t have. Vanta gets you SOC 2-ready fast.
See for yourself:
20% shorter enterprise deal cycles
$1.5M in sales unlocked in 3 months
SOC 2 Type II readiness in 3 weeks
ANTHROPIC
Image source: Anthropic / The Rundown
The Rundown: Anthropic just introduced Claude Duet, an Opus 5.5-powered personal agent standalone app that can take proactive actions, work 24/7 (even when closed), and carry out tasks on its own cloud computer.
The details:
Example tasks include morning briefs, tracking calendars, and booking meetings, with Duet able to use its own computer even when devices are off.
Duet carries over memory, skills, and connectors from the Claude app, and also gains payment functionality via a one-time virtual card from Stripe’s Link wallet.
Anthropic put a focus on security and safety for Duet, with any deletion, payment, signature, or outgoing message needing user sign-off first.
Duet conversations count as part of normal Claude usage limits, with the research preview rolling out in waves to waitlisted U.S. Max and Pro subscribers.
Why it matters: The personal agent trend is already overflowing, and we’d agree… With this one exception. Anthropic’s models are in a class of their own right now, and while Grok Bot already borrows Claude for some tasks, Duet is the only one built entirely around Opus 5.5 — a model so good it could be the edge that separates it from the pack.
QUICK HITS
COMMUNITY AI WORKFLOW OF THE DAY
▸ Shimon built an AI donor tracker that flags who hasn’t given yet
Today’s workflow comes from reader Shimon:
“I built an AI fundraising campaign assistant with Make.com. The workflow reads emails sent from the crowdfunding platform used for the campaign, extracts the relevant information, and records it in a spreadsheet.
It also uses spreadsheets from previous years’ campaigns to maintain a list of people who have not donated to this campaign yet but have donated in the past. I can ask the agent questions by email, such as who has already donated. It can also answer questions with specific parameters, such as who has not donated but previously gave more than $1,000, or how much a specific person donated.
I built the workflow in Make using its AI tools. I connected it to a Gmail account, a Google Drive account containing the spreadsheets, and a ChatGPT account that processes the information as the AI agent.”
What’s AI still not doing for you? We want to hear the task that’s still eating your time, or the thing AI keeps getting wrong. To share yours, visit The Rundown University.
🎨 Hera - Generate images, design, and animate on one canvas. Direct several AI agents at once, then edit it like a design file*
⚙️ Flint - Recursive’s first model, built for fast, local coding on laptops
🎥 Kling 4.0 - Kuaishou’s latest AI video model, now generating 30-second clips
💨 Eleven Realtime - ElevenLabs’ voice agent models that reason while they talk
*Sponsored Listing
doubleAI’s new Maxwell is the first code execution model that accelerates software as it runs, making the machine run it faster with results proven correct. Try it now.*
Flapping Airplanes secured $1B at a reported $6B valuation, with the AI lab building GPU software designed to make training and running models cheaper.
OpenAI struck a deal to sell its models and Codex through Google Cloud, with the models also landing inside Google’s own Antigravity coding app and Gemini Agent soon.
Meta is introducing a nonvoting share class to continue funding an AI buildout of up to $145B, with the success of Muse agent giving its previous spending new validation.
Humans& debuted Ampersand, an AI teammate trained in months-long simulated group chats that roughly ties Anthropic’s Fable 5.1 on the startup’s own test of helping people hit long-term goals.
OpenAI disclosed new cases of its AI agents switching off safety monitoring during internal work, with a GPT-6 model then falsely telling a user it had left the monitor alone.
*Sponsored Listing
Read our last AI newsletter: Sam Altman’s three endings for the AI safety race
Read our last Tech newsletter: What AI sees in your selfie
Read our last Robotics newsletter: Softbank’s $18B bet on robot guards
Today’s AI tool guide: Let Town prepare your next meeting brief
That's it for today!Before you go we’d love to know what you thought of today's newsletter to help us improve The Rundown experience for you. |
|
See you soon,
Rowan, Zach, Shubham, Jennifer, and Nate — the humans behind The Rundown
