🍭 AI found the bugs. Who fixes them? 🔧

Give the next step an owner.

Good morning. This week’s AI launches are moving from answers to actions: phone agents, prepared work and security fixes. The useful question is what happens after the model finishes. Who checks the booking, approves the task or deploys the patch? Today’s PHP response and Claude Duet make that handoff the part worth testing.

Today’s Menu 🥠

• The Big Bite: AI finds bugs. People still have to fix them.

• Second Bite: Barclays puts AI in its restructuring plan.

• Fast Snacks: LiteLLM, Claude Duet, a $1 billion AI efficiency bet and Meta’s cash squeeze.

• Toolbox: continuous scans, scoped permissions, managed GPU training and decision models.

• Image quiz: which rover photograph is real?

Thursday, October 22 · Read Time: 5 minutes

The Big Bite · AI and Security
🔧 AI Is Finding Bugs. Who Funds the Fix?

The Bite: Your website may have a more urgent task than adding an AI chatbot: updating the software underneath it.

On October 21, PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities. PHP runs website code on servers. Under affected conditions, these flaws could let an attacker run code without logging in.

OpenAI says Calif used GPT 5.6 Sol in the investigation through Patch the Planet, a program supporting software maintainers. PHP's maintainers led the fixes and release, with researchers and infrastructure providers helping coordinate the response.

Why it Bites: Finding the problem was only part of the job. The PHP Foundation says initial signs of one root cause appeared in 2024. Difficult compatibility choices, limited staffing and a stalled decision process delayed a fix. Later research established the danger more clearly.

AI can accelerate discovery. Experienced engineers still have to decide what changes, test it and get the update into use.

Our take: Budget for the people who close the findings, too. If your business runs a PHP website, ask your host to confirm the patched build actually running on your servers. A reassuring dashboard is less useful than that answer.

Together with Kickresume
📝 Get the feedback recruiters never send back

If you’ve ever sent your resume out and heard nothing back, you’ve probably wondered what went wrong. Now you can actually find out. Because now you can get the brutally honest resume feedback recruiters never send back. 

Resume Review reads your resume like a hiring manager would and flags what’s costing you interviews. Every issue is pinned to the exact line on the page, with a fix you can act on.

You get to pick how you want to hear it: 

- Gentle (honest, but kind) or 

- Ruthless (honest, that’s it). 

It’s free, no credit card needed, and we don’t store your resume.

Second Bite · Work and AI
🏦 Barclays Puts AI in Its Restructuring Plan

The Bite: AI productivity promises now come with a workforce plan. In today’s results presentation, Barclays links its restructuring to organizational simplification and technology changes whose efficiencies are driven by AI.

Three details matter:

• About 5,000 expected employee reductions stem from restructuring actions taken in 2026, subject to consultation. That is roughly 5% of employees, not a count of completed departures.

• Support functions, including developers, account for around 60% of roles affected by the second half actions. That percentage does not describe the entire annual total.

• More than £1.1 billion in savings is projected for 2027 from structural and other efficiency actions. Barclays does not attribute all those savings or job reductions solely to AI.

Our take: The question for workers is getting more specific: which tasks will disappear, and what work remains? Employers should explain that before treating a productivity target as a staffing plan. Retraining needs a destination, not just a course.

Fast Snacks 🥡

🔐 LiteLLM Users: Check the Release You Installed
LiteLLM’s maintainers say its October 21 release, version 1.107.0, and affected container images carried credential stealing malware. The compromised artifacts have been removed, but the investigation continues. If you installed or ran an affected artifact, follow the official response steps in order, including rebuilding clean environments and rotating exposed credentials. Removal does not recover stolen keys.

🤖 Claude wants a head start on your morning
Claude Duet prepares work on its own cloud computer, including morning briefings. The research preview has a waitlist for US Pro and Max subscribers, excluding Team and Enterprise. Background checks consume plan usage, and it can miss or misread items. If admitted, start with one briefing and check it against your actual inbox.

💰 A billion dollars for a different AI bet
Index Ventures announced it is leading Flapping Airplanes’ $1 billion Series A. The lab is pursuing more efficient AI through research into GPU kernels, training and inference. For builders, the useful question is whether that research produces measurable improvements on real workloads. Funding backs the experiment; it does not establish cheaper AI.

💸 Meta’s Growth Comes With a Cash Squeeze
Meta reported quarterly revenue of $64.6 billion, up 26%, while free cash flow fell to negative $2.12 billion. It now forecasts $135 billion to $145 billion in capital spending this year, including finance lease principal, across AI and its wider business. The useful number to watch is cash left after that buildout. Growing sales can fund an ambitious AI strategy while leaving less cash available today.

Toolbox
🧰 Four Tools for the Work Behind the Agents

Claude Security: A code scan that keeps checking after the first report. This Enterprise public beta follows repository changes, tracks fixes and connects through an API or MCP. Ask your admin to enable one project, add its deployment context and review the findings before widening access. Availability does not mean every flagged issue is confirmed.

Alter: Give each agent a defined job and access to match. Alter combines credential storage, scoped permissions, approval gates and action logs for teams building agents. Try one calendar integration with read access only, then test whether forbidden actions are denied. Its SOC 2 review is still in progress.

Databricks AI Runtime: Train models where your company’s data already lives. Now generally available, AIR provides managed GPUs for your code or containers, with CLI and notebook access, Unity Catalog controls and MLflow tracking. For teams already using Databricks, try one training experiment with a fixed budget and review its usage records. Confirm pricing, supported regions and account eligibility first; those details remain unverified here.

Baseten decision models: Route a support ticket without asking a chatbot to write an essay. Mammoth 1 and elephant 1 return probabilities across possible answers. Try a small set of labeled tickets, then measure wrong routes and cases needing human review. Baseten advertises a temporary API trial; check current terms before using it.

Test Your Skill
Snack Quiz: Choose The Real Image 🔍

One image is a genuine archival photograph. The other is an independent AI recreation. Which one is real?

Original photograph credit: NASA/Helen Arase Vargas. Source and answer reveal. No NASA endorsement.