AI finds PHP flaws dating back to 2004

Today's digest leads with AI models finding two critical PHP flaws, alongside Anthropic's Claude Duet agent app and two OpenAI deals. You will also find agent tools from 1Password and Walmart, a PyTorch update for Macs, and research on bot detection, bias, and inference costs.

AI lab releases

AI tools uncover decades-old flaws in PHP

Researchers at OpenAI and a security firm called Wiz used AI models to find two critical flaws in PHP, a language that powers many websites. The flaws existed in every PHP version since 2004 and could let attackers run code remotely without logging in. PHP's maintainers released patches within about two months of discovery, before any attackers found the bugs.

Why it matters: Sites built on PHP, including many running WordPress, gain time to patch before criminals exploit these flaws.

Sources: OpenAI, TechCrunch, Simon Willison, PHP on GitHub, CNBC

Anthropic launches proactive agent app Claude Duet

Anthropic released Claude Duet, an app that uses its Opus 5.5 model to handle daily tasks for professionals and small business owners. The app sends morning briefings, connects to thousands of outside tools, and can complete purchases through payment services like Stripe. It asks for approval before sensitive actions like payments or deleting files, and is available in the US for Pro and Max subscribers.

Why it matters: Anthropic is testing whether people trust agents to act on their behalf in daily work.

Sources: TechCrunch, The Verge, Anthropic

Acquisitions + deals

OpenAI acquires biotech startup Orchestra Bio

OpenAI bought Orchestra Bio, a startup whose AI agents coordinate the many steps involved in drug development. The deal adds Orchestra's technology to OpenAI's Rosalind platform, which already serves drugmakers Novo Nordisk and Moderna. Developing a new medicine typically takes 10 to 15 years, and OpenAI says the combined tools aim to shorten that timeline.

Why it matters: Drug companies could see AI take on more of the coordination work behind new treatments.

Sources: OpenAI, TechCrunch, GIGAZINE

OpenAI models arrive on Google Cloud

OpenAI is bringing its AI models and its Codex coding tool to Google Cloud's Model Garden, a marketplace for AI models. Businesses will be able to buy access through the Google Cloud Marketplace and use existing cloud spending commitments to pay for it. Microsoft still remains OpenAI's main cloud partner, but general availability on Google Cloud is expected within weeks.

Why it matters: Companies already spending money with Google Cloud get an easier path to OpenAI's models.

Sources: OpenAI, CNBC, Ars Technica, Reuters, Axios, 9to5Google, SiliconANGLE

MCP + agent tooling

1Password lets AI agents log in blindly

1Password launched a feature that lets AI agents sign into accounts using stored passwords without revealing them. Each agent is verified with a unique digital key, and the user must approve every access request. It currently works with agents such as Meta Muse and ChatGPT Work, with more integrations planned.

Why it matters: People can let agents sign in without exposing real passwords to them.

Sources: The Verge, 9to5Google, PCWorld, SiliconANGLE, TechCrunch

Walmart opens its store to AI shopping agents

Walmart built Agent Gateway, a server using the Model Context Protocol, a standard that lets AI agents connect to outside services. Agents can use it to search inventory and buy items, without receiving personal information or purchase history. Next month Walmart plans to let shoppers set spending limits or require approval for each purchase, and will extend this to Sam's Club.

Why it matters: Shoppers get a way to let software buy on their behalf while keeping some control over spending.

Sources: TechCrunch, The Verge

SDKs + APIs

Open-source Rust gateway simplifies AI connections

A team launched Respan, an open-source tool written in the Rust programming language that connects apps to many AI providers through a plugin system. The project replaced earlier wrapper code of more than 100,000 lines with a smaller core, cutting the code needed to support Mistral to 22 lines. It supports chat, real-time voice, and the Model Context Protocol for connecting agents to tools.

Why it matters: Developers get a lighter way to add new AI providers without rewriting large amounts of code.

Sources: Hacker News

PyTorch update speeds up AI on Macs

PyTorch 2.15 adds support for a compact numeric format called FP8 and brings large speed gains to Apple's Mac chips. Mixture-of-experts models, a type of AI model that activates only parts of itself per task, now decode five to six and a half times faster. One test model jumped from 9.4 to 61.3 tokens generated per second on an M3 Ultra chip, and video memory use dropped sharply.

Why it matters: Running and training AI models on Mac hardware becomes far more practical for developers.

Sources: Hugging Face

Web scraping + data tools

Study finds wide gaps in bot detection

A new benchmark tested five bot detection systems against regular browsers, stealth browsers, and AI agents acting like humans. Detection rates ranged from about 9.1% for Cloudflare's system to 99% for a tool called Proof of Human. Widely used tools reCAPTCHA v3 and hCaptcha caught 69.4% and 44.3% of sessions, the study found.

Why it matters: Websites relying on weaker detection tools may struggle to tell AI agents apart from real visitors.

Sources: Proof of Human Research

Research

New benchmark probes bias in AI decisions

Researchers at Allen AI built FairStress, a test that checks whether AI language models treat demographic groups differently once challenged with persuasive arguments. The benchmark covers hiring, lending, healthcare, education, and housing decisions, and was run on model families from several companies. Allen AI says models shift their decisions by different amounts depending on which demographic group an argument favors.

Why it matters: Businesses using AI for decisions like hiring or lending get a new way to check for bias.

Sources: Hugging Face

Trimming vocabulary cuts AI inference costs

Dharma AI built VocabX, a method that shrinks a language model's vocabulary based on processing cost rather than how often words appear. Applied to a Portuguese essay-grading tool built on the Qwen3-4B model, the method cut inference costs, the expense of running the model, by 77 percent. The original vocabulary held 151,669 entries, and the technique worked without changing the underlying model.

Why it matters: Companies running AI on narrow tasks may be able to cut costs without buying new hardware.

Sources: Hugging Face, The Information, The Wall Street Journal, TechCrunch

Thanks for reading, and we will be back tomorrow with more.

---

About ScrutifAI: ScrutifAI is an independent third-party agency that tests software for AI agents, building a single access point where agents and people can access and use tested tools without learning each one individually, at a fraction of the cost of buying them directly.