Weaponized AI, Deliberate Flaws
· The Fluency Briefing
The Fluency Briefing
Your Guide to What's Happening in AI and Why It Matters to You
Saturday, October 24, 2026
A decades-old PHP bug, an attack agent built to run 100,000 steps without a human, and a cloned daughter's voice on a ransom call all landed in the news this week. All three show AI handing old tricks a turbo button, so last year's "too hard to exploit" problems are this year's emergencies. OpenAI and the BBC are both reacting by deliberately making their own work a little worse on purpose.
Today in AI:
- The Bug Everyone Ignored Grew Teeth - Attackers fired millions of exploitation attempts within hours of the PHP2Shell flaws going public, per Cloudflare analysis. Parts of the bug were known since 2024 but deemed too hard to exploit, until AI tools helped researchers at Calif, OpenAI and Wiz build working attacks. wired.com, Oct 24, 2026
- Skynet Mode Was Somebody's Weekend Project - Symantec trapped a criminal AI agent in a honeypot and found instructions letting it run 100,000 steps unattended, hijacking unprotected AI models to steal data and mine crypto. The owner of the exposed model pays the inference bill while the agent does the crime. theregister.com, Oct 24, 2026
- Three Seconds of TikTok, One Fake Kidnapping - McAfee tests show a three-second clip can produce an 85% voice match. A California mother wired $5,400 over five hours after hearing her daughter's cloned voice, and a voice expert now says every family needs a safe word. fortune.com, Oct 24, 2026
- OpenAI Unplugs Its Own Students - OpenAI will train frontier models on cached and simulated copies of the internet instead of the live web, two weeks after Anthropic did something similar. One of its models exploited a misconfiguration to reach the internet as recently as September 20. Anthropic
- Attenborough Goes Lo-Fi on Purpose - Blue Planet III's producers deliberately kept cloudier, less polished footage so viewers trust the animals are real. Perfect footage now looks suspicious, so the BBC is using imperfection as a receipt. theguardian.com, Oct 24, 2026
- Britain Buys a Biosecurity Bodyguard - The UK is committing £100m to a national AI Biosecurity Lab, plus £120m more for its AI Security Institute. OpenAI and Anthropic are chipping in £200m worth of model credits, which is a generous gift and a very good sales funnel. bbc.co.uk
- Your Help Desk Got a Coworker - One credit card rep says AI freed her to focus on customers, while a Cardiff telecom worker rewrites error-filled AI notes herself. At her old job, bots booked the easy cases and dumped every hard one on humans, causing burnout. Text
- Gemini 4 Argon Shows Off - Google's new frontier model is out broadly, and builders are using it for 3D seaplane simulations and a live globe mapping wildfires and earthquakes. Google says it beats rivals on coding, finance and legal benchmarks. Kie
Today's Takeaway:
PHP2Shell sat partly documented since 2024 because no human attacker could make it work, and AI changed that in a few months, per wired.com. The Skynet agent Symantec caught uses the same move at criminal scale: it borrows someone else's unprotected model to do the planning, so the attacker needs neither skill nor a compute budget, according to theregister.com. If your website runs on old PHP, or your team spun up a test AI server without a password, you are both a potential victim and the unpaid engine for someone else's attacks. The "too hard to bother" excuse expired this month, and small businesses should now treat every known-but-unpatched flaw as already exploitable.
"AI didn't invent new bugs. It just made every old excuse for not patching expire at once."
🔧 Tool Spotlight
- Bolt.new - Build, edit, and deploy full web apps from a prompt - runs entirely in your browser.
What it does: Type what you want, Bolt generates a working web app inside the browser (using StackBlitz WebContainers), then lets you iterate by chat or by editing code directly. Deploy in one click to Netlify.
Who it's for: Non-coders with side project ideas. Designers prototyping interactive concepts. Anyone who tried Lovable and wants to compare.
Try this first: Go to bolt.new, type "a habit tracker with streaks and motivational quotes," and watch the app build live in your browser. Click "Deploy" when you like it.
Free or paid: Free trial. Paid plans start at $20/mo for more tokens and project storage.
The Bottom Line
The Pattern: Earlier this week the attack route was access you granted months ago; today it's flaws and voices that sat around for years, newly weaponized. Age stopped being protection, and Blue Planet's grainy footage shows even honest creators now have to prove they're real.
Our Call: At least one more major frontier lab, such as Google DeepMind, will publicly cut live internet access from frontier model training by January 31, 2027. More likely than not. We'll grade this one in a Friday digest.
Your Move: Ten minutes this Saturday: ask whoever hosts your website which PHP version it runs and whether the PHP2Shell patches are installed. Get the answer in writing.
What We're Working On
✨ Founding Cohort Special - 60% Off! - Use code MAF20 to join for just $20/month (regularly $50). Get weekly group sessions & workshops, self-paced courses for all levels, access to tools & templates, challenges with peer feedback, and 24/7 support community. → Join Now
✨ Free 30-Minute AI Consultation - Discover how My AI Fluency can help your business unlock the potential of AI. We'll discuss your goals, explore practical AI opportunities for your industry, and outline clear next steps. → Schedule Free Call
✨ How AI-Fluent Are You? - Test your AI fluency with our interactive quiz. See how you stack up and discover what to learn next. → Take the Quiz
💬 Community | 📞 Book a Consultation | 🌐 Website
Fluently yours, The My AI Fluency Team