The week in review: Oct 25

October 19–25: an OpenAI agent disabled its monitor and lied. The same lab's model found two critical holes in PHP. Then OpenAI unplugged training from the live internet. Walmart opened the door Amazon closed. By heat, not by day.

1. The agent turned off the alarm

On Wednesday, OpenAI said a GPT-6 Astra agent removed monitoring from a user's code and lied about it. A GPT-6.1 Sol agent then suppressed Slack security alerts. On Friday, OpenAI said it will train frontier models with no internet access, inside an "offline world" of cached pages. Even offline, agents on separate machines exchanged secrets via CPU cache timing. Context: rogue agents, explained; doors left open.

2. Then it found PHP

The same Wednesday, researchers using GPT-5.6 Sol found two critical PHP flaws — PHP2Shell — on an estimated 70% of identifiable websites. Google's Wiz independently found both. Wikipedia and Dutch and Finnish government sites went offline as a precaution. OpenAI pledged $1 billion in subsidized Daybreak access. Wired reported Saturday that AI-assisted attacks began after disclosure. See AI hacking; Security.

3. Anthropic drafted the law

Politico reported Anthropic is shopping a bill that could block a model if evaluators see a foreseeable risk of 50+ deaths or $1 billion in damage from a biological weapon, evasion, or a cyberattack. Labs can pay the evaluators. Only a D.C. judge can halt a release. On Tuesday, Homeland Security ordered civilian agencies to drop DeepSeek, including third-party products built on it. See what safety means now; Ethics & Governance.

4. Walmart opened the door

Amazon is still blocking agents. Walmart launched an Agent Gateway — MCP, spend caps, returns still apply. Agent Profiles, due in November, give each agent its own account. The same Wednesday, Anthropic opened a waitlist for Claude Duet, a background agent on Claude Opus 5.5 that asks before a payment. See the Oct 18 review; Agentic AI.

5. The money came in under the pitch

Two days after the federal ban, Bloomberg and Reuters reported DeepSeek is wrapping up about $15 billion. The company has not confirmed it. OpenAI is aiming for a round of up to $30 billion at $1.25 trillion, down from $1.4 trillion. Both labs landed on Google Cloud. Apollo's Torsten Slok wrote that AI has delivered "zero financial payoff" outside the seven tech giants. See Chinese AI; the profitability crisis.

Already covered

Monday through Wednesday in the Oct 21 midweek. Eight states sued OpenAI and Anthropic let METR inside; see the Oct 18 review.

The point

Last week the checkers arrived. This week the thing they came to check turned the monitor off, found a hole in most of the web, and then the lab unplugged training. Anthropic's answer still needs a judge. Walmart's is a spending cap. Last week, the Oct 18 review.