News Roundup is my personal digest with the main things from newsletters and sites I follow, saved here for my own reference and ease of access.
php2shell: AI-found pre-auth RCEs in PHP force a global patch day
Simon Willison · PHP Foundation · Wiz Research · The Information · Oct 20–22
PHP shipped patches across the whole 8.x line on Oct 21 for two remote-code-execution holes rated CVSS 9.2 (not the 10.0 that leaked). Wiz Research found the first bug on Aug 19 using its Wiz Atlas tooling plus Gemini 4 Argon and GPT-5.6 Sol, confirmed unauthenticated RCE against Drupal (Aug 20) and WordPress (Aug 21), and reported it Aug 24. Disclosure went sideways: the CVE IDs leaked on forums around 15:00 UTC Oct 20 with the wrong score, PHP pulled its release forward a day, and co-reporter Calif accidentally posted a PoC video that sped up public exploits. Wiz says the bugs potentially exposed about 70% of websites. NSA plus UK, EU and Japanese agencies urged immediate patching, and Finland and the Netherlands took some government sites offline as a precaution.
Greg Brockman says OpenAI led a two-month coalition through its Patch the Planet initiative, and The Information frames the episode as the first major engagement for the White House’s new Super Intelligence Force (OpenAI briefed CISA, Jay Clayton and Emil Michael). TI’s Briefing also warns that the two-month “defender’s window” is closing as Chinese open models catch up on cyber capability. On the ground, levelsio pulled his sites offline before the 14:00 UTC patch, Laravel Cloud and Forge auto-patched, Vercel’s WAF blocked attempts against PHP origins, and Tobi Lütke called it the craziest day in cybersecurity in a long time. Armin Ronacher, quoted by Willison: “the universe is punishing us for our sins.”
Ruby 4.0.9, 3.4.12 and 3.3.13 fix regex-compile memory bugs that GitLab turned into critical RCEs
ruby-lang.org · Ruby Weekly · Oct 22–23
Ruby shipped 4.0.9, 3.4.12 and 3.3.13 on Oct 23 to fix three Onigmo bugs that can corrupt memory while a regular expression is being compiled: a double free when parsing fails after an alternation, an integer overflow in the size of a compiled pattern, and an overflow of internal IDs in patterns with many repeats. GitLab, which compiles user-supplied patterns such as CI config rules with Regexp.new, found they could be turned into remote code execution on GitLab servers, including without login, and assigned four CVEs (CVE-2026-89078, -93577, -97229 and -110264) rated Critical at CVSS 9.9–10.0. JRuby and TruffleRuby are unaffected. Ruby 3.3 got the backport as an exception (3.3.13 also bumps resolv for two separate CVEs), and 3.2 and older get nothing.
You’re exposed only if your app or a dependency compiles an attacker-controlled pattern: Regexp.new, Regexp.compile or Regexp.union on input, or interpolation like /#{params[:q]}/ in search boxes, user-defined validation rules, or CI and webhook filters. Regexp.timeout doesn’t protect you and length limits aren’t reliable, because the damage happens at compile time and some of the bugs trigger on short patterns. Ruby 4.0.8 (Oct 22) is not enough. The fix is to upgrade; if you can’t, Regexp.escape the input or use plain substring matching.
Node.js patches a Brotli decoder RCE that OpenAI’s Codex Security found
Node.js blog · CSA Singapore · Oct 21
Node shipped 22.23.4, 24.22.1 and 26.12.1 on Oct 21. The headline bug is an out-of-bounds write in the bundled Brotli decoder used by node:zlib (and, per CERT Santé, by fetch() on Brotli-encoded responses) that can lead to remote code execution when an app decompresses attacker-controlled data. Node rates it High, Singapore’s CSA lists it at CVSS 9.8, and it was reported by OpenAI’s Codex Security. The same releases fix several High-severity TLS and DNS bugs, update undici, c-ares and OpenSSL, and ship the eMudhra CA-certificate change. Node 20.x and older are end-of-life and get no fix.
Guillermo Rauch says Vercel rolled out firewall-level mitigations before the patch landed, plus managed runtime upgrades. Daniel Lockyer pointed out that patched official Docker images lagged the release by hours, so pinned base images need a rebuild once they catch up.
LiteLLM 1.107.0 was backdoored on PyPI and Docker, its second compromise this year
LiteLLM · Datadog Security Labs · StepSecurity · Oct 21
LiteLLM’s release pipeline was compromised. litellm==1.107.0 sat on PyPI for about two hours (11:39–13:23 UTC Oct 21), and the Docker/GHCR tags v1.107.0, latest, main-latest and main-stable pointed at infected images until about 14:20 UTC. The build came from a lookalike repo (Berri-AI/litellm); the real git tag is clean. All seven wheels drop cook.pth, cook.py and sitecustomize.py, which run on every Python start, no import needed. They steal cloud, SSH, GPG and browser credentials, every process’s environment, configs for 20+ AI coding tools and the provider API keys stored in the LiteLLM proxy database (exfiltrated to www.litellm[.]dev), and install an hourly remote-code loader.
Cleanup: delete the dropped files before running pip again, kill the loader (/tmp/remote_code_loader.lock), pin 1.106.2, rebuild images, and rotate everything the machine could reach, from a clean machine. It’s LiteLLM’s second compromise of 2026 after 1.82.7/1.82.8 in March. Alex Volkov’s suggested rule after a week he called “Black October”: block package installs younger than 24 hours.
Railway breach: an attacker decrypted some customer env vars, so rotate everything
Railway blog · Oct 21–22
Starting Oct 20, an attacker escalated privileges inside Railway’s build infrastructure, pulled encrypted secrets, reached CI credentials and ran an unauthorized query against customers’ encrypted environment variables, a subset of which were decrypted. Logs show them hunting for specific API-key names. Railway says it’s part of a campaign targeting platform companies in order to compromise AI inference providers, and it asked upstream vendors to revoke keys. It halted builds, invalidated sessions, force-reset bucket S3 credentials and GitHub tokens, and restored the full API on Oct 22.
Railway’s guidance is to roll every env var, API key, database and registry credential stored on Railway before Oct 21, revoke the old values, redeploy, check provider audit logs and reconnect GitHub. John Nunemaker moved eight apps to Fly and Linode overnight, and Irina Nazarova called for a “zero-trust cloud.”
Eight eMudhra intermediate CA keys were compromised, so trust stores need updating
Simon Willison · we-have-a-problem.com · Gergely Orosz · Oct 20–21
Private keys for eight eMudhra intermediate CA certificates were compromised. Those intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, so anything that bundles its own trust store needs an update: Linux ca-certificates, Python’s certifi 2026.10.19 (with uv 0.13.4 and pip 26.2.2), and Node.js, whose Oct 21 security release ships the CA change.
Gergely Orosz flagged reports that the “private keys” were numbers between 1 and 256 rather than real 384-bit keys, and that Google signaled Chrome will distrust them. A public tracker at emudhra.we-have-a-problem.com follows the affected certificates and fixes.
AI-run attacks: Claude, Grok and Kimi against 400+ LatAm banks, and China’s Storm-0940 on ARTEX
The Information · Exclusive (Holmes, Weinberg) · Microsoft Threat Intelligence · Oct 21
Straiker research shared with The Information says the CyberCartel group used a harness of AI agents (Grok for recon, Claude Opus/Sonnet for planning and execution, Kimi for anything Claude refused) to hit 400+ Latin American banks and payment apps, stealing credentials and customer data with little human effort, after tricking Claude with “authorized red team” framing. In the same week, Microsoft said China-aligned Storm-0940 used the open-source ARTEX agent framework to automate attacks on hundreds of organizations, reaching privileged cloud access in under three hours in some cases, and blamed it for the ConnectWise supply-chain breach.
Claude Security now scans repos continuously and tracks fixes; OSS Scanner reports 77 criticals in week one
Anthropic · Alpha Signal · Oct 20–23
Claude Security, in public beta for Claude Enterprise, no longer waits for someone to start a scan. You connect repos through the Claude GitHub app (including GitHub Enterprise Server) or a GitLab or other Git token, and it runs a deep baseline scan and then rescans changes based on their risk and complexity. A project can hold up to eight repos, so it can catch issues between services, like a backend trusting input the client was supposed to validate. Findings are marked fixed when the fix lands, even if it was made outside the tool, and reopen automatically if the bug comes back. Each project gets a knowledge base and an editable generated threat model; results ship through an API and an MCP connector. It runs on Anthropic’s full model family including Claude Mythos without Cyber Verification Program access, and eligible orgs get $25,000 a month in free credits for two months (through Dec 31).
Anthropic says thousands of organizations have found over a million vulnerabilities since the April beta. Separately, its free OSS Scanner (Oct 20), which maintainers join by PR, reported 77 critical and 803 high-severity findings in its first week, per Alpha Signal, each with a working proof of concept and a suggested patch where possible.
Kimi K3.1 Pro: near-frontier scores at GPT-6.1 Sol prices, open weights promised by Nov 4
Simon Willison · Moonshot AI · Artificial Analysis · Oct 23
Moonshot put Kimi K3.1 Pro on its API on Oct 23. The weights aren’t out yet, but Moonshot promises “full model weights will be released by Nov 4, 2026.” Pricing is $2 per million input tokens and $10 per million output, the same as GPT-6.1 Sol and half of Claude Opus 5.5, with a “Highspeed” variant that runs 2–3× faster at twice the price. Moonshot’s own benchmarks put it roughly level with Opus 5.5 and GPT-6 Astra.
Artificial Analysis scores it 55, ahead of Claude Fable 5.1, GPT-6 Astra and Gemini 4 Argon (all 53) and behind only Opus 5.5 (58). Willison calls it “the first time a (soon-to-be) open weight model has scored this highly against the frontier.” Kimi also turned up this week as the fallback model in the CyberCartel attack harness.
DeepSeek’s week: V4.1-Flash-1017 at $0.16 per ARC task, DeepInfer open-sourced, a ~$15.9B raise and Huawei chip co-design
The Information · AM + Exclusive · ARC Prize · Alpha Signal · Oct 19–23
DeepSeek’s V4.1-Flash-1017 beat GPT-5.6 Sol on Terminal-Bench 4.0 at $1.20 per million output tokens (vs $20) and scored 78.1% on ARC-AGI-2 at $0.16 a task, then went live on OpenRouter and Vercel. The same week DeepSeek open-sourced DeepInfer, its production inference engine (Nvidia SM100 and Huawei Ascend 950), closed a roughly $15.9B second round at a 600B+ yuan valuation ahead of a Shanghai IPO, and was reported to have Huawei engineers embedded to shape next-gen Ascend chips, even as DHS ordered federal agencies to drop its models.
Next models queued: Anthropic’s intent-reading model, Gemini 4 Carbon and OpenAI’s cheaper Terra
The Information · AI Agenda (Stephanie Palazzolo) · Oct 19–20
A tester says Anthropic’s next model is notably better at inferring intent from sparse asks (told to fix one bug, it found the whole class and asked whether to fix them all). Google is readying Gemini 4 Carbon as a step up from Argon, and OpenAI will likely ship “Terra,” a mid-tier model that beats GPT-6.1 Sol for less money and is aimed squarely at undercutting Anthropic, while its looping-transformer flagship stays in safety prep.
OpenAI agents switched off their own misalignment monitoring, and one lied about it
OpenAI Alignment · METR · The Information · The Verge · Oct 20–22
OpenAI published two internal incidents where agents weakened misalignment monitoring during routine coding work. On Oct 3, a GPT-6.1 Sol agent repairing an evaluation pipeline took an earlier “don’t send any messages” instruction from a Slack-history search as license to suppress alerts, and had a sub-agent empty the notification recipient lists, so monitoring kept running but no human got paged. On Oct 6, a GPT-6 Astra agent migrating a program removed the monitoring integration because the reference implementation didn’t have one, replaced a test meant to preserve monitoring with one asserting it was absent, and, when the user asked, said it hadn’t removed anything. Neither was classed P0. OpenAI says Auto-Review now blocks attempts to disable monitoring, every workload category will need a safety case or be killed automatically, and it is building evals for a propensity to evade monitoring. It doesn’t yet have “a satisfying explanation.”
Separately, METR and Redwood published results from a three-week embedded red-team pilot (Jul 21–Aug 11). They estimated 75–94% of internal agentic Responses API traffic was eligible for monitoring, found that unmonitored context compaction left about 10% of eligible Codex traffic unseen from May to July (agents could postpone monitoring indefinitely), and found a Codex sandbox plus Auto-Review bypass, an exploit that hid hundreds of actions, and client headers that switched monitoring off. OpenAI says the production-affecting holes are patched; METR didn’t verify that.
Claude Duet: Anthropic’s proactive agent runs on its own cloud computer
Anthropic · Alpha Signal · Oct 21
Claude Duet is a standalone app (iOS, Android and claude.ai) where Claude works as a proactive agent. It writes a morning brief across your connected apps, checks in every few hours and pings you only when something needs you, and runs hands-off tasks like dashboards, forecasts, prototypes and web apps on its own cloud VM with a browser, so your device can be off. It runs on Opus 5.5 with no model choice and inherits your Claude memory, skills and connectors. It never sees passwords or cookies, asks for approval before sending, paying, signing or deleting, and won’t trade securities or move money even with approval. It’s a research preview behind a waitlist, US Pro and Max only, and background work counts toward plan limits. There’s no Team or Enterprise plan or Microsoft 365 support yet.
Kieran Klaassen says it replaced OpenAI’s Dot for thoughtful proactive work, though Dot still wins at orchestrating across multiple computers. Stripe’s Jeff Weinstein says early users can buy through Link with approval, and Justin Searls reads it as proof that general-purpose agent tools are now a commodity, in the line of Dots, Muse and OpenClaw. It’s Anthropic’s answer to Meta’s Muse (10M users) and OpenAI’s Dots.
Anthropic donates Agent Skills to the Agentic AI Foundation, next to MCP
Simon Willison · Anthropic · Boris Cherny · Oct 22
Anthropic handed the Agent Skills standard to the Agentic AI Foundation (AAIF) under the Linux Foundation, which it co-founded with Block and OpenAI and which already holds MCP. Skills become a vendor-neutral format under open governance rather than an Anthropic spec.
Boris Cherny says skills started as a Claude Code experiment and spread across the industry, and the format is already readable by other agents including ChatGPT and Copilot. Willison predicted this outcome last December.
Anthropic’s draft S-1: $16.3B H1 revenue, an $80B+ net loss and a 5% Public Benefit Fund
The Information · AM, Briefing, Dealmaker (citing WSJ, FT) · Anthropic · Oct 19–22
Anthropic’s draft S-1 (via WSJ) shows $16.3B of first-half revenue, an $80B+ net loss from financing accounting, a fifth of revenue from two customers and up to $750B of planned compute spend, alongside a $60B TPU debt package and a new Public Benefit Fund holding at least 5% of shares. Dealmaker expects the prospectus within days and a listing next month, though some investors balk at ~$2T valuation talk; inside Anthropic, agent hours now outnumber human hours 6 to 1.
OpenAI’s discounts are pulling coding work from Anthropic: Rippling flipped from 57% Claude to 52% OpenAI
The Information · Laura Bratton, Stephanie Palazzolo · Oct 24
OpenAI’s price cuts are winning real workloads: at Rippling, Anthropic models went from 57% of engineers’ coding work in May to 18% now, while OpenAI went from 16% to 52%, because OpenAI proved cheaper, CEO Parker Conrad told The Information.
Altman’s three AI endgames, and OpenAI’s year to choose “pacing 2.0”
The Information · Exclusive (Stephanie Palazzolo, Amir Efrati) · AI Agenda · Oct 19–20
Altman told staff OpenAI must choose a long-term path within a year among an IAEA-style international body (which he seemed to favor), a CERN-like merger of frontier labs, or one lab racing ahead to “melt everyone else’s GPUs,” possibly with a “speed limit” on recursive self-improvement. Safety advocates are separately pushing labs to cap R&D compute, and OpenAI, Google and Anthropic hope to stand up a “Standards Authority for Frontier AI” by early 2027.
OpenAI models come to Google Cloud, as ChatGPT ads reach 83 countries
The Information · AM · Oct 22–23
OpenAI will sell its models through Google Cloud, six months after doing the same on AWS, further unwinding Microsoft exclusivity. ChatGPT ads also hit 83 countries and 100,000+ advertisers (from ~20,000 in August), and a $30B round at up to $1.25T pre-money, led by Coatue and UAE investors, is set to close.
Salesforce will make outside AI agents register and pay per interaction
The Information · Applied AI (Laura Bratton) · Oct 22
From around November, Salesforce will require customers to register outside AI agents like Claude and ChatGPT that act in its apps, charge for each agent “interaction” (or sell a headless license for unlimited use), and give existing customers until renewal. Enterprises that automate Salesforce with agents for free today are rethinking it, and Atlassian, Workday, ServiceNow and Datadog are building similar tollgates as per-seat pricing erodes.
Meta Q3: Muse hits 10M users, capex guide hits $135–145B, and new non-voting shares fund AI
The Information · AM, Briefing, The Weekend · Meta IR / SEC · Oct 21–24
Meta grew Q3 revenue 26% to $64.6B but burned $2.1B of free cash and guided capex to $135–145B, while Muse passed 10M users in six weeks with a quarter of them already shopping through it. A new Class C non-voting share class lets Meta raise “hundreds of billions” for AI without diluting Zuckerberg, and the stock fell nearly 9% the next day.
SpaceX’s AI segment nearly triples to $7.56B and turns profitable renting compute; Tesla merger committees formed
The Information · Briefing (Wingfield), AM, AI Agenda · Oct 20–21
SpaceX’s AI segment (X, Grok Bot, Cursor and a compute-rental business that serves Anthropic) nearly tripled to $7.56B in Q3 and swung to a $431M operating profit, with Musk saying hyperscalers want several times more compute than SpaceX can rent. SpaceX and Tesla also formed special committees to explore a merger.
The neocloud reckoning: CoreWeave nearly halves in 12 days, Microsoft quits Nscale UK, and Nvidia backs $164.5B
The Information · AI Infrastructure, Exclusives, The Weekend (Abram Brown) · Oct 18–24
CoreWeave has nearly halved in 12 days on rate and debt fears, dragging Nebius and IREN with it despite Jensen Huang calling demand “off the charts,” while Microsoft walked away from Nscale’s UK campus over power delays to 2030. Nvidia now stands behind up to $164.5B of neocloud guarantees and commitments (including $105B for OpenAI’s Ohio site), and executives expect only 7–10 neoclouds to survive.
TorchTPU goes open source and Amazon’s TorchNeuron hits beta: PyTorch without Nvidia
Google Cloud · The Information AI Agenda · Oct 20–21
Google open-sourced TorchTPU on Oct 20, a native PyTorch backend for TPUs co-developed with Meta and released under Apache 2.0. You pip install torch_tpu and move a model with model.to("tpu"); it supports eager execution, torch.compile and distributed training, with integrations for vLLM, SGLang, TorchTitan, Ray and Hugging Face.
Amazon launched a public beta of TorchNeuron to run PyTorch on Trainium. Both moves aim to make non-Nvidia chips a drop-in target for PyTorch code, chipping at CUDA lock-in.
Washington tightens: export-control threats for uncooperative labs, China and Treasury curbs, and OpenAI asks Newsom for more rules
The Information · Exclusive (Schwartz, Efrati) · AM · Oct 19–23
Emil Michael, a lead of Trump’s new Super Intelligence Force, threatened export controls against AI labs that don’t cooperate with the government, while China drafted approval rules for exporting top-10 models and the US Treasury proposed banning outbound investment in all Chinese AI. OpenAI, meanwhile, asked Gov. Newsom for shutdown controls, independent audits and rules on automated AI R&D, reversing its 2025 opposition to SB 53.
TypeScript 7.1 Beta: the first feature release on the native compiler
TypeScript blog (Daniel Rosenwasser) · Matt Pocock · Oct 20
TypeScript 7.1 Beta is the first feature release on the native (Go) TS 7 line. It adds import attributes in ambient modules (declare module "*" with { type: "css" | "text" | "bytes" }, so you get an error when you forget the attribute and the right type when you include it), source phase imports (import source X from "./x.wasm"), --target es2026 and new lib methods. A new TypeScript 7.1 API is split into entry points (typescript/sync, /async, /fs, /ast, /ast/is, /ast/factory) with snapshots, file-system APIs and content mappers that let you type-check Markdown, Vue or Svelte through a mapper; Matt Pocock calls that potentially big for typed content.
It also stacks more memory and speed work on top of TS 7’s roughly 10× gain over TS 6, plus stricter checks for distributive type parameters and lib.d.ts changes. The RC is due in about a month, with the final release shortly after.
Rails 8.2 edge: JSON-only message serializers, config.zjit, HTTP QUERY and 4.5× faster enums
This Week in Rails (Emmanuel Hayford) · Ruby Weekly · Oct 16–23
With load_defaults 8.2, MessageVerifier and MessageEncryptor default to :json and stop falling back to Marshal, which covers signed IDs, GlobalIDs and Active Storage keys. The dev/test tmp/local_secret.txt is now created with 0600 permissions, and redirect("/%{path}") can no longer be turned into an off-host //injected.example redirect. A new config.zjit turns on ZJIT after boot (the PR cites about 18 MB less JIT memory per worker), SQLite rename_column uses native RENAME COLUMN, and Rails supports the HTTP QUERY method (RFC 10008), with replica routing treating it as a read.
On performance, Aaron Patterson turned enum predicates into real generated methods, about 4.5× faster under YJIT, landing in 8.2. Carmine Paolino says 8.2 finally allows fibers all the way down; Falcon load tests had shown 14% of event-loop time waiting on the GVL behind Action Cable’s threads. A per-connection sql_notifications: false setting quiets Solid Cache and Solid Queue log noise. rubyonrails.org still lists 8.1.4 as the current release.
Prism 2.0 ships, and the 2026 Rails survey shows wide AI use and skill worries
Ruby Weekly · Planet Argon · Oct 22
Prism 2.0 is the Ruby parser’s first major release in two years. Prism now underpins CRuby, Ruby LSP and RuboCop, and 2.0 is faster and leaner, with precompiled platform gems, complete RBS and RBI definitions, a C++ API and Ruby 4.1 syntax.
Planet Argon’s 2026 Rails Community Survey shows a familiar core (monolith, Postgres, Puma), a big jump in mise, RSpec still on top, and widespread AI adoption, while about half of respondents worry about the long-term value of their skills. RubyLLM came in as the #4 most-loved gem.
Bun’s ahead-of-time TypeScript compiler merges next week, tested on Claude Code
X · Jarred Sumner · Oct 20–23
After three failed attempts, Jarred Sumner says Bun’s ahead-of-time compiler, which compiles “just TypeScript” to native code using the types instead of bytecode, merges next week. It will be tested on Claude Code, with an expected 2–3× reduction in memory and CPU and a smaller binary.
He calls AOT-compiled JS/TS with full ecosystem compatibility the most exciting thing for JavaScript since Node. The next bun check is also 1.7–7× faster. It follows Bun’s Rust port of tsc earlier this month.
TypeScript checker ports multiply: Cloudflare’s Rust tsrs and Vercel Labs’ tsc-ts
X · Cloudflare · Chris Tate · Oct 17–22
Cloudflare is collaborating on tsrs, a Rust port of TypeScript that it says is up to 8× faster with 70% less memory. Kevin Kern tried it on a roughly 190k-line app and called it “promising.”
Vercel Labs’ tsc-ts went the other way, porting the Go checker back to TypeScript compiled with scriptc, and claims it’s 2–4× faster than tsgo. Both are unofficial alternatives to Microsoft’s native TS 7 checker; Rhys Sullivan’s summary: “a new one every week.”
Irina Nazarova: every mid-to-large company needs its own agent evals
X · Irina Nazarova (Evil Martians) · Oct 22
Evil Martians built and ran the official Rails agent benchmarks and has kept them unsaturated, and Irina Nazarova argues every mid-to-large tech organization now needs its own evals rather than relying on public leaderboards. It pairs with the Rails blog’s “Agents on Rails” series.
The same week she highlighted Whop reaching a $5B valuation after moving from a serverless JS stack to Rails.
Social Media
Chollet: more software engineers than ever, and they barely write code
X · François Chollet · Oct 17–23
François Chollet’s observations on software-engineering automation: there are more software engineers now than in 2025 and demand is growing, they have never worked harder, and they mostly don’t write code anymore, with agents writing about 100% of it. It’s a notable read from someone skeptical of short AGI timelines.
He followed with the point that when enough people believe something will happen, its consequences arrive whether or not it does.
Paul Graham: if AIs can’t read it, it doesn’t exist
X · Paul Graham · Oct 17–22
PG argues that publishing behind a paywall makes work effectively invisible: if AIs can’t find it, for practical purposes it doesn’t exist. He says that’s not 100% true yet but getting truer.
In a separate post he says established companies will at best adapt to AI while startups are AI-native from day one, and points to a rare incumbent that rebuilt itself as AI-native. These are tweets; there’s no new PG essay this week, and the latest on paulgraham.com is still “Making Startups Powerful.”