Edition
Friday, October 23, 2026
17 issues
23h window
~15 min read
Running through today’s issues
AI found the bug, so patch latency is now the whole defense
3 sources
Clouded Judgement traces the critical PHP flaw to OpenAI's "Patch the Planet" audit of a 14-year-old bug previously dismissed as too hard to exploit, with the models doing the tedious exploit-chaining humans never finished. Superhuman AI reports exploit attempts scaling from thousands to millions within hours once it leaked, driven by agent swarms. Every's own team used Codex to inventory exposed credentials after the Railway breach and the Every Agent to track rotation hourly. Both offense and defense are automated now, which means the loss happens entirely in the window between disclosure and patch — and OpenAI says more findings are queued.
Equity still clears at scale; the debt and listing markets do not
4 sources
Blackstone's Jas Khaira said plainly that the firm has not mapped out who buys all the data-center debt, in the same week CoreWeave fell another 10% and Firmus pulled its IPO. SB Energy pushed its listing to December or later after targeting September. Yet OpenAI is closing $30B at up to $1.25T with Coatue and UAE money, and DeepSeek raised $15.9B at over 600B yuan. Private equity funding for frontier labs is abundant; the public credit and IPO channels the infrastructure actually depends on are closed.
Agents are becoming billable headcount rather than a product feature
3 sources
Salesforce will require registration of externally built agents from November and treat each action as a billable interaction, with Atlassian, Workday, ServiceNow and Datadog building comparable tollgates. Anthropic's own report says agent hours inside the company already outnumber human employees six to one. Every describes agents as active Slack participants with their own etiquette problem — a DM from someone's agent that the sender may not have read. Per-seat pricing is being replaced by per-action pricing because the unit of work moved off humans.
Superhuman AI
06:10 PT
🔐 How to protect yourself during Black October
So what
Your portfolio companies on PHP 8.1 or older have no patch available at all — that is a live exposure, not a maintenance item.
The issue's main section is given over to "Black October," arguing that AI-driven exploitation has turned a quiet PHP bug into an internet-wide emergency. Everything else — Canva's first in-house image model, Meta's new share class — reads as filler beside it.
- Critical PHP vulnerabilities leaked before patches shipped; exploit attempts scaled from thousands to millions within hours, driven by agent swarms. Wikipedia, Archive.org, 4chan and government sites went offline
- Axios reports major banks detecting third-party agents operating inside customer accounts; Microsoft says a China-aligned actor hit hundreds of organizations with automated attacks
- Canva launched Craft, a two-step model that plans layout before rendering, 55 languages, 4th on Design Arena behind three OpenAI models
- Meta proposed nonvoting shares to fund AI spending and let Zuckerberg pay a 5% California wealth tax; Q3 revenue $64B, up 26%, with ~$825B in future spending commitments disclosed
- Getty Images filed for bankruptcy after the Shutterstock merger collapsed; valued near $5B four years ago
Clouded Judgement
06:04 PT
Clouded Judgement 10.22.26 - AI Goes Vulnerability Hunting
So what
Ask every portfolio company how fast it can ship a patch once a disclosure lands; that number is now a diligence item.
Jamin Ball's read on the PHP and LiteLLM incidents: the third category of vulnerability — known but too hard to exploit — has stopped existing, because models do the tedious chaining work humans abandoned.
- The PHP flaw lets attackers execute code and read live process memory, exposing passwords, auth tokens and API keys from other users' requests. PHP runs ~70% of websites; the bug existed 14 years
- A limited version was found in 2024 and written off as too hard to exploit. The NSA told organizations to patch immediately or take servers offline
- It surfaced through the PHP Foundation's partnership with OpenAI's "Patch the Planet" program; PHP wrote the fix while OpenAI coordinated mitigations with Cloudflare, AWS, Google and Microsoft pre-disclosure
- A malicious LiteLLM build harvested credentials from everyone routing model calls through it
- OpenAI says more significant vulnerabilities sit in its queue; no patch exists for PHP 8.1 and older
- SaaS comps: median 4.8x EV/NTM revenue, top 5 median 33.1x, high growth 21.0x, low growth 7.1x
Not Boring
05:34 PT
Weekly Dose of Optimism #216
So what
OpenAI is now co-investing in cancer therapeutics alongside Founders Fund — frontier labs are taking equity in the bio stack, not licensing into it.
Packy McCormick's optimism issue runs cancer, nuclear, consciousness and genetically engineered working dogs, with frontier labs showing up as investors in all of it.
- FDA granted dostarlimab accelerated approval as standalone first treatment for dMMR stage II and III rectal cancer; 71% progression-free at 26 months in GSK's 154-patient trial, 93% cancer-free at a year in MSK's 50-patient study. Only ~3% of cases are dMMR
- Coherence Neuro raised a $45M Series A from Founders Fund and OpenAI to read and modulate the electrical signals around tumors; glioblastoma trials underway
- The Nuclear Company proposed Prosperity One: up to six AP1000s, 6.6 GW, 4,000 acres in Lewis County, Kentucky, targeting 2028 NRC approval. Vogtle Unit 4 came in 30% cheaper than Unit 3, which TNC treats as the floor
- Warhound launched with $200M from In-Q-Tel, Sequoia and 8VC at a $1.2B valuation, licensing Colossal gene editing and Anduril hardware for enhanced working dogs
- Doris Tsao's lab found the same neurons alternating every ~60ms between the conscious and suppressed face in binocular flash suppression; Electric Plant raised $11.2M for Bombadil, trained on 4M hours of plant recordings
The Information
04:00 PT
OpenAI Fundraising Round Set to Close Soon With UAE Investors, Coatue Leading Investment
So what
The proposed rule drops the compute threshold and covers all AI and biotech, so re-screen any China-adjacent position before the December 7 comment deadline.
The Friday AM briefing stacks four capital-flow items, and the through-line is that money is still clearing at scale for frontier labs while Washington narrows where it can go.
- OpenAI aims to close a $30B round valuing it at up to $1.25T pre-money before the end of next week, led by Coatue and UAE investors; Bloomberg had previously reported a $1.4T target
- Treasury proposed widening outbound investment restrictions to cover all AI systems, high-bandwidth memory, hypersonics and biotech across China, Russia, North Korea, Venezuela and Cuba. Comment open until December 7
- DeepSeek closed 106B yuan ($15.9B), more than double its 50B yuan target and roughly double its June round; valuation now above 600B yuan with a Shanghai listing in preparation
- Google partnered with Voltus on a 1 GW virtual power plant in the PJM region serving 67 million people, paying homes and businesses to cut peak usage — up from 100 MW earlier this year
Ben Thompson (Stratechery)
03:00 PT
Sharp Tech on Video: Netflix Angst, the End of the Internet, and Meta’s VR Glasses
So what
Skip this one; the substance arrives Sunday on the subscriber feed, including whether Y2K maps onto today's AI anxiety.
An administrative email rather than analysis: Sharp Tech is now available on video, on YouTube and hosted on Stratechery for subscribers avoiding ads.
- Public episode covers Netflix angst, the end of the internet, and Meta's VR glasses
- Sunday's subscriber-only episode takes Ubiquiti, Spotify's monthly-only subscription strategy, ChatGPT plugins, AI Show-and-Tell, and whether Y2K rhymes with today's AI fears
- These video notification emails will now go out weekly; preferences are adjustable in Passport
The Information
18:01 PT
OpenAI Races Ahead as Safety Questions Mount
So what
OpenAI's ad business went from nothing to $1B annualized inside a year — your 2027 consumer ad-spend model is already out of date.
A curated OpenAI digest arguing the company is monetizing faster than it is making its next model safe, and that both facts land before an IPO.
- ChatGPT advertisers grew to about 60,000 from 20,000 in late August; annualized ad revenue hit $1B. Overall annualized revenue neared $50B at the end of September
- Roughly 10% of compute has shifted toward safety work ahead of the next flagship; Altman reportedly told staff OpenAI must choose a path on pacing within a year
- Altman described three endgames for AI, including one where a single firm "melts everyone else's GPUs"
- OpenAI is hiring from Meta and slashing ad prices; it is also eyeing an acquisition to build a cybersecurity business, and its math results are rattling cryptography leaders
- Nvidia has put more than $170B on the line for neoclouds; OpenAI, Google and Anthropic hope to launch a Standards Authority for Frontier AI by year-end or early 2027
The Information
17:31 PT
Anthropic’s Elevator Problem: Persuading Investors to Share Its AI Dream
So what
Anthropic lists into weak AI sentiment; the allocation discount sits in the gap between Amodei's conviction and Wall Street's.
Cory Weinberg's argument is that Anthropic's insiders believe things Wall Street does not, and that belief gap — not growth — is the risk in its IPO.
- Prospectus expected within days, listing expected next month, with bankers privately floating a valuation near $2T
- Investors at last week's San Francisco investor day came away thinking rapid growth does not justify that number; Amodei's presentation was described as "uplifting"
- Anthropic's own "AI Expectations Gap" report: 91% of 1,300 employees surveyed expect a Nobel-level AI breakthrough by 2030, versus 39% of Americans. A companion report says agent hours inside the company outnumber human employees six to one
- JPMorgan CFO Jeremy Barnum on the analyst call: "The benefits aren't observable in our current quarterly earnings"
- Peter Thiel called AI "the furthest thing from a monopoly imaginable," placing Google, Meta, Grok and China not far behind Anthropic
- Open-source models doing white-collar work for a fraction of Anthropic's price remain the obvious bear case
The Information Briefing
17:01 PT
The Briefing: Blackstone Bets on Compute Scarcity
So what
Blackstone's own AI lead says nobody has modeled who buys the AI debt — size your infra exposure against that admission.
Blackstone told analysts that the constraints threatening the AI buildout — power scarcity, local opposition, rising financing costs — are what make its existing assets valuable. The same briefing documents those constraints hitting Blackstone's own book.
- Schwarzman argued power limits and public opposition to new data centers make existing facilities more valuable; Gray said the firm may seek higher returns on unleased projects to offset borrowing costs, and called data centers its highest-returning area
- CoreWeave shares closed down another 10% Thursday; Firmus pulled its IPO this month. Blackstone has lent billions to CoreWeave and both invested in and lent to Firmus
- Blackstone's Google TPU joint venture started with $5B equity, could need $25B total including debt, targets 500 MW next year, and has reportedly hit site delays
- Jas Khaira, who leads Blackstone's AI investment push: "We have not mapped out who's going to buy all the debt... we don't know where all of it will come from"
- Meta fell 7% on concerns it will issue new equity to fund AI spending; a16z dropped "crypto" from its flagship blockchain fund, now a16z Frontier
ChatGPT (OpenAI)
16:48 PT
Credit score questions? ChatGPT can help
So what
OpenAI just put a credit bureau inside ChatGPT, so every personal-finance app you hold now competes with a free default.
A product announcement, not commentary: OpenAI has put credit-score tracking inside ChatGPT through an Experian connection, free on existing plans.
- Finances in ChatGPT now tracks a user's credit score and notifies them when it changes
- The connection is made directly through Experian, with OpenAI handling the prompt layer
- Included at no additional cost with current subscriptions — distribution rather than a new capability
- Suggested prompts are supplied in-product once the account is linked
James Clear
13:39 PT
3-2-1: On being proactive, learning to cook, and optimizing for impact over fame
So what
Nothing operational here; the usable line is that deciding quickly lets you correct faster, which argues for shipping agent pilots before certainty.
No AI content. Clear's issue pairs a case for speed with a case for long horizons, and argues they are not in conflict.
- "Overnight success always takes a year or two"
- Speed is rewarded: decisive decisions can be corrected faster, problems solved while small, dreams started today. "Don't rush, but don't wait"
- Long-term intent changes short-term action — which stocks you buy, which partner you look for, which workouts you do
- Julia Child on learning anything: "The only real stumbling block is fear of failure. In cooking you've got to have a what-the-hell attitude"
- George Eliot from Middlemarch on unhistoric acts and lives "lived faithfully a hidden life"
Sacra
13:30 PT
$150m/year free speech higgsfield
So what
Every safety tightening at a frontier lab routes demand to someone reselling its own API without the refusals.
Sacra's thesis is that Venice has built a real business out of other labs' refusals — an uncensored multimodal gateway whose growth curve tracks competitors tightening their own moderation.
- Sacra estimates Venice at $150M annualized revenue in September 2026, up 15x from $10M at year-end 2025
- Raised a $65M Series A from Dragonfly in July at a $1B valuation — 14.3x the then-$70M run rate
- Founded May 2024 by Erik Voorhees of no-KYC exchange ShapeShift, as a right-libertarian ChatGPT alternative with zero data retention and crypto payment via DIEM and VVV tokens
- The inflection came when xAI tightened safeguards on Grok Imagine's app and site in January 2026 but left its API permissive; Venice repackaged it as Grok Imagine Private, driving 100% MoM video generation growth in April and again in May
- Now multiplexes Seedance, Kling, Wan and its own Venice Uncensored. Comparables: Higgsfield at $1B annualized, last valued at $5.4B; OpenArt at ~$100M
The Information
12:45 PT
WTF 2026: Five days out, limited seats remain
So what
If you're tracking the AI IPO window, Lynn Martin and Kim Posnett are both on stage in Napa on Tuesday.
Pure event marketing with five days to go before the WTF Summit, though the speaker list maps the people currently pricing the AI IPO window.
- October 27-28 at The Estate Yountville, hosted by Jessica Lessin
- Bari Weiss on her next chapter at CBS News; Whitney Wolfe Herd on the future of Bumble
- Lynn Martin of NYSE and Kim Posnett of Goldman Sachs on the next wave of tech IPOs; Amanda Peterson Corio of Google on AI infrastructure
- Receptions and dinners alongside the stage program; subscribers get an additional $200 off when logged in
Every
12:01 PT
Reminder: Codex for Power Users 2.0 is tomorrow
So what
It runs today at noon ET and you already paid for it; the demos cover Codex features shipped since the last session.
A one-line reminder for a workshop running today, aimed at people already using Codex rather than beginners.
- Codex for Power Users 2.0, Friday October 23, noon to 1pm ET on Zoom
- Led by Micah Rich, Every's head of AI education
- Live demos of new Codex capabilities and how the Every team is using them in production
- Included with an existing subscription; no need to have attended the earlier session
The Information
11:04 PT
Salesforce Wants a Fee Every Time an AI Agent Touches Its Software
So what
Price your Salesforce renewal assuming per-interaction agent fees, and have your data-portability answer ready before November makes it leverage.
Laura Bratton reports Salesforce building a tollgate for externally built AI agents, and argues the whole software industry is testing whether per-action fees can replace per-seat revenue.
- From around November, customers must register any outside AI agent taking actions in Salesforce apps; each action counts as a billable "interaction." Prices are not yet announced
- A "headless license" option offers unlimited agent usage. New customers get a three-month grace period after pricing is announced; existing customers are unaffected until renewal
- Atlassian, Workday, ServiceNow and Datadog are erecting similar tollgates to varying degrees
- Consultant Nick Hamm says most of the 150 enterprises he works with already run Anthropic and OpenAI agents inside Salesforce for free, and may move data out of Salesforce apps if fees run high
- Salesforce frames registration as security — each agent gets its own identity and narrower permissions — but it is unclear how it polices OpenClaw-style agents running locally
- Lumen's CIO Jim Fowler says Salesforce has so far let existing subscription fees cover built-in AI sales agents; Lumen is waiting on pricing before testing the new connectors
Every
10:57 PT
🎧 Keeping Up With AI Is a Full-time Job
So what
Copy the frontier-team split: one small crew tracks new models so the rest of your team can stay on the roadmap.
Every's case is that keeping up with AI is a full-time job, so it hired a small team to do only that — and the newsletter shows the structure handling a live security incident.
- The frontier team gets hands on every new model and converts experiments into products for a main team that stays on roadmap; Dan Shipper calls it "kind of transformative." Members include Mike Taylor on evals, Arielle Shipper on operations, Jack Cheng, Katie Parrott, Jannik Jung and Kieran Klaassen
- Railway disclosed that hackers may have obtained decrypted API keys and database passwords while app updates needed to rotate them were paused
- Every used Codex to compile every potentially exposed credential with a likely owner, then had the Every Agent post hourly per-person progress. Willie Williams estimates the inventory alone would have taken hours, plus a dedicated person working overnight across time zones
- Loren Stewart's three-prompt pattern: one coding agent writes a prioritized fix plan, an agent from a different provider critiques it, the first revises. Arielle turned it into a skill named /loren
- Andrey Galko on agent etiquette: "When you use a tool to talk to someone, you make them a tool too"
The Information
10:51 PT
Exclusive: SB Energy Considers Waiting Until December or Later for IPO
So what
Two data-center listings are now stalled; mark your exit window on private infra paper to 2027 rather than this quarter.
A short scoop: SoftBank-controlled SB Energy is weighing a December IPO or a wait into next year, having targeted September.
- SB Energy is developing the large planned Ohio data center project for OpenAI
- The public market has turned against data center and AI cloud listings since August
- Australian cloud firm Firmus pulled its IPO earlier this month; others are considering delays
- The bull case is that compute supply gets tight enough that investors warm back up to data centers
The Information
10:27 PT
Exclusive: Datadog Offered $4 Billion to Buy Security Startup ‘Upwind’
So what
A $4B bid at no premium tells cloud-security founders in your portfolio to take the round instead of the acquisition.
Datadog offered close to $4B for cloud security startup Upwind, and the terms say more about Upwind's leverage than Datadog's appetite.
- Upwind has not accepted the offer
- It is finalizing a $300M round at roughly $3.8B, so the bid carries almost no premium to the private mark
- Upwind monitors cloud applications — including AI agents — and detects and automatically responds to potential breaches
- The Information frames it as evidence of white-hot interest in cloud security firms