The AI vs AI Battle for the Internet

The episode opens by briefly introducing Anthropic’s Claude Duet, which the host says is the company’s answer to products such as Grokbot, Meta’s Muse, and OpenAI’s “dots.” The host postpones a full analysis for a planned Sunday episode, partly because the cybersecurity developments covered later are too important to ignore and partly because he wants to spend more time testing Duet and its competitors. Anthropic appears to be targeting professionals and small businesses. Duet’s main differentiator is proactivity: each morning it can send a brief covering important items across connected apps, monitor those apps throughout the day, and message the user only when something requires attention. It can handle routine tasks such as scheduling meetings as well as more complex work, including building dashboards, producing financial or sales forecasts, and prototyping or building web apps. It includes a virtual machine, persistent memory, connectors, and safety controls requiring explicit permission for major actions such as payments or deleting files. Anthropic also described a dedicated classifier and safety system prompt intended to prevent sensitive-information leaks. Duet is currently a research preview with a waitlist. Anthropic warned that it may misread threads or misjudge urgency and will be less capable at personal errands such as booking tickets because of its work focus. The host says the immediate excitement centered less on proactivity than on Duet being built on Opus 5. He argues that questioning the target audience may be a category error: work and personal life overlap, so agents may ultimately need to handle both. Signals’ broader conclusion was that the competition is shifting from model intelligence to ownership of a persistent user relationship, especially since the capabilities needed for many workflows may have reached a practical plateau.

The host contrasts Walmart’s decision to welcome personal agents with the more cautious positions of Amazon, JPMorgan, and Bank of America. Shopify has taken an emphatic yes position, while JPMorgan and Bank of America are primarily concerned about agents mishandling customers’ money; Amazon’s objection is more focused on competitive risk. Walmart’s openness is notable because it already has its own shopping agent, Sparky, and recently reported that Sparky users had order values 40% higher than non-agentic online shoppers. Beginning the following month, Walmart customers will be able to link a personal agent to their account with configurable spending limits, similar to a child’s account. Walmart’s terms say an agent must not act beyond the shopper’s intent and may not modify payment methods. Purchases will require approval by default, and Walmart says it can ban agents that violate the rules. At the same time, compliant agents will receive the normal returns-policy protection, even when an agent makes a mistake. The host says it is too early to make firm predictions about agentic commerce, but early usage suggests shopping is becoming an important use case. Meta said one quarter of active Muse users shop with the agent, with average purchases of about $200. Mark Zuckerberg said the company had not previously seen activity like that occurring through its connector. The host concludes that if early agent users are unusually valuable customers, Walmart may simply want to let them shop through whichever agent they prefer rather than forcing them into Sparky.

Meta announced a new class of non-voting stock alongside its third-quarter earnings report. The stock is expected to begin trading in January and would let Meta raise equity capital without reducing Mark Zuckerberg’s voting control. Meta also modestly raised the low end of its current-year data-center spending forecast, from $130 billion to between $135 billion and $145 billion. CFO Susan Li said the scale of investment needed to compete, sustain growth, expand infrastructure, and pursue new strategic initiatives during the AI transformation is significant. She later described the new stock as a way to expand Meta’s funding tools and preserve flexibility while the company sees AI-driven momentum across its businesses. Some observers interpreted the move as evidence that the bond market may be running out of capacity for AI-related debt. The host notes that Meta could instead be hedging against that possibility rather than responding to an immediate financing crisis. Meta reportedly has about $900 billion in liabilities, including $350 billion in non-cancellable data-center contracts, although only roughly $83 billion is currently represented by issued long-term bonds. Financial planning advice attached to the earnings report said Meta might need to raise several hundred billion dollars in coming years. If it issued voting stock, it could still raise as much as $700 billion without reducing Zuckerberg’s voting share below 50%. The host’s “Occam’s razor” interpretation is that Meta is keeping every capital source available. Investors initially accepted some dilution, with Meta’s stock rising in overnight markets, but the long-term meaning for the buildout remains unclear.

The main episode returns to Anthropic’s Project Glasswing, announced in April after Anthropic observed that its frontier model Mythos could find and exploit software vulnerabilities better than all but the most skilled human specialists. Anthropic said a preview had already found thousands of high-severity vulnerabilities, including flaws in every major operating system and web browser. Glasswing gave a small group of governments and companies access to Mythos so they could find and fix vulnerabilities before attackers did, while Anthropic warned that these capabilities would eventually spread and could threaten economies, public safety, and national security. The host frames recent incidents as evidence that the transition is already underway. The Hugging Face incident involved a fleet of OpenAI agents breaking containment to reach Hugging Face systems. An attack on OpenCode compromised about 1.5% of its users’ accounts and used their access to run up bills on AI-company APIs. The episode’s central event, however, is a newly disclosed PHP vulnerability that researchers say could affect as many as 70% of websites and web apps. The vulnerability was discovered about two months earlier using GPT 5.6 Sol by a security researcher at Calif and independently by Wiz. OpenAI coordinated with PHP maintainers, Wiz, Cloudflare, and other partners on mitigations. The flaw, called “PHP 2 Shell,” allows remote code execution without authentication, meaning an attacker could control a backend server and do essentially anything with it. It affected even current PHP versions. A PHP security engineer called it the language’s most severe issue in more than a decade and compared it with Heartbleed, which triggered a global patching effort in 2014.

OpenAI said the vulnerability was found by frontier AI before attackers exploited it, creating a defensive window. The host emphasizes that the window was narrow: knowledge of the exploit apparently spread roughly 10 hours before public disclosure, before organizations could update their systems. Many government and commercial websites went offline as a precaution, and the NSA recommended that organizations take systems offline until they were patched. The FBI Cyber Division asked organizations to report intrusions. The host says he normally approaches “the sky is falling” cybersecurity claims skeptically, but the reactions from security practitioners made this incident appear genuine. Breck Units called it potentially the biggest destructive event on the internet in 20 years and said about 70% of websites could be vulnerable, possibly without knowing they had already been compromised. Cloudflare CEO Matthew Prince reported thousands of exploit attempts before disclosure, tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions afterward. Other commentators warned that AI agent swarms could be attacking large portions of the internet. Several people criticized the disclosure process. They asked why patches were not released immediately after the vulnerability and proof of concept began leaking, and why the public was apparently given a day to prepare. The explanation the host found most credible is that releasing the patch would make the exploit obvious, so publishing the fix would also reveal how to attack unpatched systems. The NSA’s warning to take sites offline was therefore intended to create time for patching before the vulnerability details became broadly usable. The incident also raised concerns about abandoned websites: commentators predicted that years-old PHP sites could become permanently inaccessible, with some forums, games, archives, and other sites already going offline.

The episode adds a second recent incident: Railway, an AI-hosting service similar to Vercel, detected suspicious activity involving systems storing customer environment variables. Railway said an unauthorized third party may have accessed encrypted variables and obtained the plaintext contents for some of them. Those variables can contain API keys, database credentials, and registry credentials. Railway believed the attack was part of a series targeting platform companies in order to compromise AI-inference providers, and advised users to rotate API keys and all stored environment variables. The incident resembled OpenCode, where stolen API access was used to consume tokens and generate large bills. OpenCode’s Dax described the emerging pattern as continuous and expansive: attackers will become more sophisticated, probe every system surface and employee, and exploit old projects that organizations have forgotten. He said OpenCode was surviving only because agents were operating around the clock, while the team was barely sleeping. The host presents this as a possible “new normal,” ranging from Joshua Achiam’s prediction of internet lockdowns within months to the more pragmatic view that AI must be used to defend against AI. Entrepreneur John Naughton said rotating keys across many projects would once have been an impossible operational nightmare, but AI made it possible quickly. Aaron Levie argued that AI can scan every log, line of code, network flow, and data source at a scale that was previously incomprehensible. He expects enterprises to use vastly more tokens for cybersecurity and to need both agents and human professionals to direct them, review findings, patch systems, and respond to incidents. Tal Hoffman summarized the competitive dynamic as fleets of defensive agents versus cheap, relentless offensive swarms: whoever coordinates faster wins.

The host says there are several possible futures. One is a crisis severe enough to produce broad internet restrictions, while another is an arms race in which defenders use AI to match attackers. Former OpenAI president Greg Brockman argues that new defensive approaches will be necessary, potentially including authorized government systems scanning the internet for vulnerable hosts and, in extreme situations, patching them remotely. He calls this a new phase of cybersecurity in which models can find vulnerabilities with internet-scale consequences and says defenders must apply models to their own systems, shared infrastructure, and best-practice networks. The more optimistic argument is that AI will eventually make software more capable, secure, and reliable. The host accepts that possibility but stresses that long-term optimism does not eliminate short- or medium-term chaos, pain, and disruption. He compares the current moment to other AI transitions, including jobs, where the eventual outcome may be positive but the path can be destructive. The episode’s final conclusion is that cybersecurity is moving from a world of manageable, human-paced vulnerabilities into one defined by AI-versus-AI coordination. Attackers can discover weaknesses at superhuman speed, while defenders must use agents to monitor, patch, and respond continuously. The winners will not necessarily be the organizations with the smartest isolated model, but those able to coordinate fleets of systems, people, data, permissions, and incident-response processes quickly enough to keep up.