Menu

Notes

AI found two critical PHP flaws before anyone else did

Two critical vulnerabilities in PHP were found with AI under OpenAI's Patch the Planet programme, and fixes shipped on 21 October. Security tools from AWS, GitHub and Anthropic now go past finding flaws to proposing the fix.

The same capability that found these flaws is available to attackers. For a product team the consequence is simple: how quickly a fix reaches production is no longer an engineering detail. It is a number a product manager should know for every system they own.

For product people: If anything you run uses PHP, apply the fixes. More broadly, the time between a flaw being found and being exploited is shrinking, so patch speed is now a product metric.

Source: OpenAI, Patch the Planet, 21 October 2026, via AI for Products' weekly brief issue 01.

Notes

More notes

  • The Agentic AI Foundation now holds ten projects, from three

    The Agentic AI Foundation took in four more projects: Agent Skills from Anthropic, Open Responses from OpenAI, OpenEnv from Hugging Face and OpenSandbox from Alibaba. It now holds ten projects, up from three.

    For product people: Build an agent skill once and expect it to work across assistants. Standards are how a team's prompts and skills become an asset rather than a lock-in.

    Source: The Agentic AI Foundation, October 2026, via AI for Products' weekly brief issue 01.

  • OpenAI models come to Google Cloud, next to a managed Claude

    OpenAI's models are coming to Google Cloud, and Anthropic now offers a way to run Claude on Google Cloud that Anthropic itself manages.

    For product people: On Google Cloud you can now try both without a new contract. Choose the Claude option by who handles your data, not by the logo.

    Source: Google Cloud and Anthropic, 22 October 2026, via AI for Products' weekly brief issue 01.

  • Decision models: an answer without the essay

    Three decision models arrived in one day: OpenAI's Decisions API became generally available, Liquid AI released d1 and Ollama released d3. They answer a question with a choice rather than a paragraph.

    For product people: A surprising share of the steps in a workflow are choices, not prose. Those steps suit a decision model: faster, cheaper and easier to test.

    Source: OpenAI, Liquid AI and Ollama, 22 October 2026, via AI for Products' weekly brief issue 01.

All notes