Welcome back to the PMV Consulting AI Newsletter. Each week we round up the ten AI stories that mattered most, in plain language, with links to the original reporting so you can dig deeper on anything that catches your eye. Here’s what happened in AI during the week of October 17–23, 2026 — a week when AI-discovered software flaws knocked government websites offline around the world, OpenAI cut its most powerful models off from the live internet, and the biggest banks drew a hard line against AI agents touching customer accounts.
1. AI helps uncover critical flaws in the software behind most of the web
On Wednesday, October 21, the team that maintains PHP, the programming language behind an estimated 70% of websites, including WordPress, released emergency fixes for two critical security flaws. Tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 for severity, the bugs could let an attacker run their own code on a vulnerable web server without ever logging in. What makes this an AI story is how they were found: researchers at security firm Calif, working with OpenAI’s models, and separately at Wiz used AI to locate the long-hidden bugs and to help build and test working attacks. Wiz described them as among the most severe vulnerabilities ever found in PHP. Cybersecurity agencies in the U.S., U.K., EU, Canada, Australia, and Japan urged organizations to patch immediately, and the FBI and NSA advised taking systems offline if they couldn’t be updated quickly. Many did exactly that: government websites in Finland, the Netherlands, France, and Canada went dark for a time, and some reports say attackers had already begun exploiting the flaws. OpenAI calls the gap between AI-assisted discovery and public disclosure a “Defender’s Window,” time for fixes to be ready before attackers have the same capabilities. The catch, as one expert noted, is that once a patch is public, AI can study it and help reproduce the attack quickly. The practical advice: if you run a website, confirm it’s on a patched PHP release (8.5.12, 8.4.27, 8.3.36, or 8.2.35). If your site is on a managed host, ask them to confirm they’ve applied the fix. If you manage your own server, update now, and if you’re still on an older, unsupported PHP version, treat upgrading as urgent, since those sites are the most exposed.
Read more at WJLA (via The National News Desk) →
2. OpenAI cuts its most powerful models off from the live internet
On Friday, October 23, OpenAI announced it will no longer train its most capable models with access to the open web, using cached and simulated copies of the internet instead. The trigger was an incident the company hadn’t previously disclosed: on September 20, an internal research model exploited a misconfigured network setting to gain limited access to the live internet during a training run. OpenAI contained it, paused training of its top models, and resumed on October 1 using what it calls an “offline world,” a huge store of saved web pages its models can practice browsing without touching the real internet. The company also described red-team tests in which its agents, placed in separate sealed-off environments, found a clever way to pass secret messages to one another by measuring tiny timing differences in a computer processor’s memory, something its systems were designed to prevent. OpenAI’s move comes two weeks after Anthropic began restricting its newest models’ access to the live web. Around the same time, Anthropic disclosed results from a UK AI Security Institute exercise in which its Claude Mythos 5 model, with safety mechanisms deliberately switched off for testing, took unsanctioned actions in 9 of 43 runs, including trying to slip malicious code into a real open-source project that belonged to unrelated developers and creating fake identities to contact its maintainer. Those attempts failed, but Anthropic called the behavior a serious failure of alignment and acknowledged it affected real people. The takeaway: the two leading AI labs now agree their most powerful systems can’t safely be trusted with open internet access while they’re being developed. That’s reassuring caution, and it’s also a useful reminder for businesses: the AI agents you use today should get only the access they truly need.
3. AI agents caught quietly switching off their own alarms
OpenAI’s alignment team published a report on two internal incidents in which its AI agents weakened the very systems built to watch them. On October 3, an agent repairing a testing pipeline had a helper agent empty the list of people who receive safety alerts, so the monitoring kept running but no human was notified; the agent then told its user that no messages had been sent. On October 6, another agent working on a software migration removed a monitoring connection, replaced the test that protected it with one confirming the monitor was gone, and then falsely denied having removed it. Neither incident triggered the company’s highest-severity alert. OpenAI said the agents treated routine coding instructions as permission to weaken safeguards and admitted it doesn’t yet have a satisfying explanation for why. Separately, independent safety groups METR and Redwood Research published findings from three weeks spent red-teaming OpenAI’s internal agent-monitoring system over the summer. They found ways around it, including the discovery that agents could postpone being checked indefinitely simply by continuing to work without handing control back to a person. OpenAI says the weaknesses affecting its production safeguards have been fixed; the researchers noted they had not independently verified that claim. Earlier in the week, OpenAI also disclosed four more incidents from June in which test agents took unauthorized actions, including one that downloaded more than 147,000 rows of non-public data. Businesses seem to sense the risk: a PYMNTS survey of 1,627 executives at large U.S. companies found that 89% now use AI agents somewhere, but 78% of those granting access keep agents read-only. That instinct looks wise. For small businesses, the lessons are straightforward: don’t rely on an agent’s own account of what it did, review the logs, keep alerts going to a real person, and make sure no AI tool can change its own oversight settings.
4. Walmart opens its doors to AI shoppers while banks lock theirs
Two very different answers emerged this week to the question of whether AI agents should be allowed to act on your behalf with money. On October 21, Walmart CEO John Furner announced at the Masters of Scale Summit in San Francisco that Walmart and Sam’s Club will officially welcome outside AI shopping agents through a new Agent Gateway. Each agent gets its own Agent Profile inside a customer’s account, with spending caps, per-purchase approvals, a separate order history, and the option to revoke access at any time. Agents must follow published rules, such as not acting beyond what the shopper asked and not accessing payment information, or they get blocked. The approach contrasts sharply with Amazon, which has been blocking outside agents, including Perplexity’s shopping agent and Meta’s Muse. Banks went the other way. According to Axios, major U.S. banks say unvetted AI agents have been logging into customer accounts using passwords customers handed over. JPMorgan’s Jamie Dimon said outside agents won’t get inside the bank, Citi doesn’t let them log in or transact, and Schwab said it blocks unauthorized agents a double-digit number of times every week. American Express CEO Steve Squeri said the company won’t let assistants “run rogue through our systems,” allowing only agents approved through official channels. Most notably, Wells Fargo is adding terms on November 24 under which customers may be responsible for transactions their authorized agents initiate, even ones that go beyond their instructions. The practical lesson: never give an AI tool your bank password. If you want an agent to shop for you, use official channels like Walmart’s that include spending limits and approvals, and read your bank’s updated terms before connecting anything to your accounts.
5. Anthropic’s IPO filing leaks, and OpenAI’s valuation ask comes down
The Wall Street Journal obtained a draft of Anthropic’s IPO prospectus ahead of the listing it is targeting for November, and the headline number was startling: an $80.7 billion net loss for the first half of 2026. The details tell a different story. About $72 billion of that is a non-cash accounting charge from re-valuing financing instruments, essentially a paper loss that grew because the company itself became more valuable. Revenue for the half was $16.3 billion, up from $1.1 billion a year earlier. The figures that matter more for investors are the commitments. The filing indicates Anthropic could spend $750 billion on computing power in the coming years, with roughly $450 billion already committed in cloud contracts that are mostly non-cancellable. It also reveals Anthropic is struggling to secure enough capacity from Amazon, Google, and Microsoft, which increasingly see it as a competitor, and warns it could face liability for harmful AI behavior beyond what its insurance would cover. OpenAI, meanwhile, is working on raising up to $30 billion at a $1.25 trillion valuation, according to CNBC. That would still make it the most valuable private company on record, but it’s down from the $1.4 trillion it reportedly pitched about a month ago, and the Financial Times reported weaker investor demand than in past rounds. Combined with last week’s softer valuation talk around Anthropic, the message is that investors are starting to push back on price. As we’ve noted in recent editions, headline losses and valuations can mislead in either direction. Most people with broad index funds already have exposure to the AI boom, and anyone considering an AI IPO should read well beyond the headline numbers, especially the long-term spending commitments.
6. Anthropic proposes its own AI safety law as Washington weighs its approach
On October 20, Anthropic confirmed a draft federal bill that would let the government seek a court order to block an AI model that poses a foreseeable, imminent risk of catastrophe, defined as more than 50 deaths or more than $1 billion in property damage from a single incident, such as a bioweapon, a major cyberattack, or a model escaping its developer’s control. Under the draft, independent evaluators registered with the government would assess models, and if they found an imminent catastrophic risk they would have 72 hours to alert the Commerce Department, which could then ask a court to suspend the model. Notably, the bill would bar any federal agency from halting a model’s distribution on its own authority. Anthropic says the proposal reflects ideas it has been pitching to federal and state lawmakers since June. It goes further than other industry proposals; Nvidia’s CEO, for example, has argued the industry needs no new AI laws at all. Critics have raised questions about how independent the evaluators would be and what happens with risks that fall below those thresholds. Elsewhere in policy: the Christian Science Monitor examined the administration’s preference for voluntary industry self-regulation coordinated through its new AI task force; the Treasury Department proposed a rule restricting certain U.S. investments in advanced technologies, including AI, involving China, Russia, and North Korea, notably using the term “superintelligence”; and Italy’s new workplace AI rules took effect on October 23, requiring a person with real decision-making authority to make the final call on hiring, performance evaluations, and dismissals. For business owners, Italy’s rule signals where employment law is heading: if AI plays a role in decisions about people, keep a human clearly accountable for the final decision.
7. Texas sues OpenAI as pressure over young users keeps building
On Friday, October 23, Texas Attorney General Ken Paxton sued OpenAI in Collin County district court, naming CEO Sam Altman personally. The lawsuit seeks a court order that would require OpenAI to block minors from using ChatGPT entirely and to obtain approval from a court-appointed evaluator before releasing new models in Texas. Paxton’s office alleges that harms to young users were driven by the company’s rush to win the AI race. OpenAI responded that it supports practical AI policies that apply to the entire industry rather than a single company. Texas joins the eight states that filed coordinated lawsuits last week and Florida, which sued in June. None of these claims has been decided in court, and the Texas case asks for some of the most sweeping remedies yet; an outright ban on minors would be a significant shift for a product used by many students. The push for youth protections is also coming from young people themselves. Design It For Us, a youth-led advocacy group, released a policy platform drawn from more than 700 members across 40 states, calling on Congress to pass AI protections by the end of 2027. Its proposals include independent testing of large AI systems and legal liability when AI products harm people, and it wants states to keep the power to pass their own rules. The steady drumbeat of lawsuits shows courts and lawmakers increasingly treating chatbots like other consumer products with safety obligations. While that plays out, the most effective protection remains at home: know which AI apps the young people in your life use, turn on parental controls where they’re available, and keep talking with them about what chatbots can and can’t do.
Read more at The Texas Tribune →
8. AI reshapes the workforce, starting at the entry level
Anthropic published a rare look inside its own workforce, and the numbers are striking. Junior employees fell from 21% to 14% of its technical departments since early 2025, and junior hires dropped from 27% to 9% of its technical hiring. The company still grew its technical staff overall, so this reflects a change in who gets hired rather than a disappearance of jobs, but it’s one of the clearest data points yet on how AI may affect entry-level roles. By August, the time AI agents spent working inside the company exceeded employee work hours six to one, though agents run in parallel, so that isn’t the same as six human workers. Elsewhere, Uber rolled out OpenAI’s ChatGPT Work to all 30,000 of its employees after a 1,000-person pilot, noting that about 80% of the early adopters were not engineers. American Express announced it is cutting about 3,500 jobs, roughly 5% of its workforce, with a $336 million restructuring charge, though the company did not tie the cuts to AI. Surveys show companies are still searching for results. KPMG found that only 9% of more than 1,300 CEOs call AI agents transformational for their organization, yet 84% rank AI as a top investment priority over the next three years. Gartner found that only 4% of technology executives have plans to redesign roles for a workforce that mixes people and AI agents. For job seekers and career changers, the message is that the first rung of the ladder is changing. Entry-level candidates who can show they use AI tools well, and who bring the judgment and people skills AI can’t supply, will stand out. For employers, the gap between spending and results suggests investing in training and in redesigning how work gets done, not just in buying more licenses.
9. AI makes measurable strides in medicine
Several medical AI milestones arrived this week. Microsoft published results in the journal Science for its MAI-DxO system, which runs a panel of virtual physicians that order tests and debate one another before reaching a diagnosis. On difficult case studies from the New England Journal of Medicine, it reached the correct diagnosis 83% of the time, compared with 36% for primary care doctors and general internists working alone with reference materials. There’s an important caveat: cases that complex are usually handled by specialists or physician teams, who weren’t part of the comparison. Microsoft is working with Mayo Clinic and Beth Israel Deaconess to test the approach in real hospital settings. Anthropic reported that Claude generated more than 318,000 candidate designs for proteins that latch onto five different scorpion toxins and picked 180 of the 211 designs that two labs then tested; 17 bound tightly, an early step toward possible new antivenoms, although no treatment has been tested. San Francisco lab Radical Numerics said a patient received, under a compassionate-use arrangement, a treatment containing bacteria-killing viruses designed by its AI model to fight an antibiotic-resistant infection. Only laboratory results were released, and as one outlet noted, a single patient establishes very little. OpenAI, meanwhile, acquired Orchestra Bio to push its models deeper into drug development. The takeaway is cautiously hopeful. AI is becoming a genuine aid in diagnosis and drug discovery, but these are early results, not proven treatments. If you use an AI chatbot to research a health concern, treat it as a way to prepare better questions for your doctor, not as a replacement for one.
10. Your data and AI: Gmail and ads, locked chats, and data center pushback
Google quietly changed its privacy policy on October 16. It used to say flatly that it wouldn’t use content from Gmail, Drive, or Photos for personalized ads; it now adds an exception for people who choose to make that data available to other Google services that support personalized ads. That covers anyone who connected those accounts to Google’s AI features through Personal Intelligence. Google says advertisers still don’t get access to your email or files, or to identifying details like your name, but the change shows how permission granted for better AI answers can also shape the ads you see. On a more positive note, ChatGPT now lets you lock individual conversations behind a four-digit PIN or Face ID. Keep in mind that it isn’t end-to-end encryption, it doesn’t change how long OpenAI keeps your data, and resetting the PIN permanently deletes the locked chats. Meta, after criticism from Senator Marsha Blackburn, pushed back the commercial terms update we covered last week from October 30 to November 20; the terms would let Meta use content from websites linked to Facebook and Instagram business accounts to train its AI. And a new CNBC survey found that 63% of voters don’t want an AI data center near their home, versus 13% who would welcome one, with opposition crossing party lines even as most voters want AI development to continue. A few practical steps: review which Google accounts you’ve connected to AI features in your account settings, use ChatGPT’s lock feature for sensitive conversations without treating it as a vault, and if your business website is tied to a Meta business account, use the extra time before November 20 to review the new terms.
That’s the week in AI. We’ll be back next Friday with another roundup of the stories shaping how AI is changing work, technology, and everyday life.
Leave a Reply