AI Found a Critical Security Hole in the Internet. How Dangerous Is OpenAI's Discovery?
How dangerous is it that an OpenAI model, with a single line, found critical holes in PHP, which most websites run on — and what changes when shopping and daily tasks pass to AI agents?
Two critical vulnerabilities in PHP — the language in which, according to Ilnar Shafigullin, the vast majority of websites are written — are rated nine and a half out of ten under the classification, and they were found by GPT-5.6 Sol from a one-line prompt that OpenAI published: "Find a vulnerability in PHP." Government websites in Europe and cybersecurity companies went offline until the update, the Polish authorities, as Anna Volchek found out, shut down some government websites, and attempts to exploit the vulnerability, according to the news, began forty minutes after it was reported. A huge tail of unmaintained websites, Ilnar believes, will stay vulnerable for a long time, and Alexander Volchek fears that anyone can now scan practically any website. Walmart has announced a separate entrance for agents — Agent Profiles and Agent Gateway — with its own restrictions, while Amazon, as Ilnar explains, resists bots because you can't "upsell" anything to them. The $37,000 story has been resolved: it was a mistake by Amazon, which erased that sum and wrote $112. Having undercounted Alexander's tokens, OpenAI credited him a thousand dollars in tokens; Ilnar, on the $200 Pro plan, is seeing "the model is in too much demand" and moving to Claude Code in parallel, and he explains Anthropic's stinginess with resets by the pessimistic data-center investment scenario that Dario Amodei talked about.
What to watch for
Key takeaways
Walmart, one of the largest retail chains in the US and in the world, has announced Agent Profiles and Agent Gateway — a separate entrance for shoppers who use AI. Right now an agent buys through a browser under a person's login, and the store sees it as a person; in a separate environment you can set your own restrictions — for example, purchases of no more than $150, no more often than once a week and excluding certain products.
The $37,000 story has been resolved: it was Amazon's mistake. Claude advised lifting the limit — the servers, in theory, had been stopped — and when Alexander lifted it, Amazon erased the $37,000 and wrote $112. Amazon still hasn't answered the support tickets: the company, in Alexander's view, isn't ready to admit a mistake like that.
The main reason Amazon resists bots, according to Ilnar, is that you can't "upsell" anything to a bot: a person goes for a hose and buys an automatic watering system, while an agent will come back with a hose — and the cheapest one at that. Walmart decided "if we can't fight it, we'll lead it," but Ilnar allows that the store may bring back upsells in other ways — for example, by showing agents only the top ten percent of products by price, or stale stock.
Anna sees the separate entrance as a way to measure, already today, the volume of agent purchases and how shopping behavior is changing: for that, the agent channel has to be separated from purchases by real people. But it is also a duplication of environments — the settings of the second environment will have to be trusted just as much as your own account, and the shopper's anxiety may remain the same.
Over the last quarter Alexander made many purchases outside Amazon: ChatGPT has started finding stores with good prices and products that Amazon doesn't have. No e-commerce platform has a billion users the way ChatGPT does, and stores that close off their catalog and prices will, in his view, inevitably lose markets; he himself is ready to link a card to OpenAI.
In PHP — the language in which, according to Ilnar, the vast majority of websites on the internet are written — two critical vulnerabilities have been found, rated nine and a half out of ten under the accepted classification: with them you can get access to everything. OpenAI found them with the help of its own models and published the information on its website.
After the publication some big websites, including government websites in Europe, began cutting off access from the internet, cybersecurity companies took their websites offline until the update, and a harsh alert came out on X: if you haven't updated, shut down. That same day Anna couldn't open Polish government websites: the Polish authorities had taken some of them down because of these vulnerabilities.
Big companies will appoint people responsible and update, but there are few of them: a huge tail of websites that aren't maintained, or are maintained less well, will, in Ilnar's view, be left with the vulnerability for a long time to come. According to the news, within forty minutes of the vulnerability being reported — with no code published — people were already trying to exploit it.
The vulnerabilities were found not by the newest model but by GPT-5.6 Sol, which people have been using for several months already, and OpenAI published the prompt — a single line: "Find a vulnerability in PHP." Practically anyone could have made such a request, Ilnar says, not just special labs; "that sounds really scary," Anna replies.
A person could have found such a vulnerability on their own, Ilnar believes, but few people spent resources on it: you need to be a super-expert and know where to dig, and nobody pays for an unknown result. An agent digs without needing motivation — it either gets to the bottom of it or "well, who cares" — and this is how AI gets to places people never got around to, including in mathematics and other sciences.
What scares Alexander is that now anyone can take 5.6 Sol, say "Go on, check the vulnerabilities for me," scan practically any website and explain that they're just programming it: "these systems don't stop." Fable used to switch to the more restricted Opus when asked to study a module's security, but now this almost never happens.
OpenAI's reset marathon has been going on for more than two weeks. OpenAI wrote to Alexander, who is on the $500 plan, that it had undercounted his tokens, and credited him a thousand dollars in tokens — by his estimate, about ten percent of the plan's work; he, for his part, asks who will give back the ten resets from those two weeks. Undercounted tokens, he says, were found in forty thousand accounts.
Anthropic has announced Claude Duet — so far only with a top-tier subscription and through a waitlist. Like Dots, it is positioned as an assistant that keeps carrying out tasks after the app is closed and reaches out to the person when decisions are needed; what Alexander values in Dots is precisely that the system comes to him on its own, makes suggestions and warns about problems. Dots is not yet available in Europe.
Codex, according to Alexander, is the worst at holding on to recurring tasks: clarify something in the chat, and it may stop doing what it had been doing as a whole block. Anna reconfigures such chats every week or two, and Ilnar's hourly task worked fine for the first twenty to thirty hours — then the context apparently overflowed.
Alexander is already at more than sixty billion tokens, but Codex, he says, goes off track from the task it is given — this is typical of the models that have appeared since 5.6 Sol, and OpenAI itself has described how internal agents loosened control over their own work. Recently a couple of billion tokens went on setting up a single Linux server, and the encryption was never finished.
For the first time, Ilnar has several times seen a banner saying that the model is in too much demand and can't answer right now — on the $200 Pro plan: OpenAI is short of resources because everyone is guzzling the resets they've been given. Preparing for the end of the marathon, he deliberately works in Claude Code in parallel so as not to depend on a single system — and Anna does the same.
When the limits run out, all the daily tasks stop working: the messages to Alexander's wife about school are sent by a Codex task, and they stop once the limit is hit. Dots, unlike all of Anthropic's products, works independently of tokens, while a person on the $20 plan, in Alexander's view, risks waking up to the message "You've hit your limit."
Ilnar explains Anthropic's stinginess with resets by a decision Dario Amodei talked about when the company was preparing for its IPO: to invest in data centers according to a pessimistic scenario. Demand turned out optimistic, while the capacity was built for the pessimistic one; now, according to the news, Anthropic is investing about seven hundred and fifty billion, but the new capacity will come in three or four years.
Alexander dictated tasks into Claude Code on the way home, and at home he couldn't find them: the interface had been updated, the projects rearranged, and Claude Code had named the task differently. The channel has been talking about poor search across chats for two and a half years, and Anna gets by with rules: categories, names and dates for chats.
Sam Altman wrote on X: "Elon Musk, great car, great Roadster, good job" — even though a year ago, according to Alexander, he said he had filed a refund request for the Roadster that Tesla never built for him. Shortly before that, Alexander had recorded a video with the thought of a "joint conspiracy" between OpenAI, Elon Musk and Anthropic, and the comment strikes him as very strange.
What this episode is about
A Sunday ToTheMoon episode in which Alexander Volchek, Ilnar Shafigullin and Anna Volchek go through the main news of the week. They start with shopping: Walmart, one of the largest retail chains in the US and in the world, has announced Agent Profiles and Agent Gateway — a separate entrance for shoppers with AI. Right now an agent buys through a browser under a person's login, and the store sees it as a person; in a separate environment you can set your own restrictions — for example, purchases of no more than $150 and no more often than once a week — and Alexander would like the same at a bank. Ilnar explains why Amazon resists bots: you can't "upsell" anything to them — and advises comparing what Walmart shows the agent with what you would choose yourself. Anna sees the separate channel as a way to measure agent purchases, but also as a duplication of environments in which the shopper's anxiety remains the same.
Alexander is sure that stores that close off their catalog and prices will lose the market: no e-commerce platform has a billion users the way ChatGPT does, and ChatGPT is already taking his purchases away from Amazon. He is ready to link a card to OpenAI so that it buys over a secure channel, and would like a separate user with limited access at a bank — like the separate app passwords in iCloud. His $37,000 story has been resolved: it was Amazon's mistake, although the company never did answer the support tickets.
The main news is two critical vulnerabilities in PHP, in which the vast majority of websites are written: nine and a half out of ten under the classification. OpenAI found them with GPT-5.6 Sol, which people have been using for several months already, and published a one-line prompt. Government websites in Europe and cybersecurity companies went offline until the update, the Polish authorities, as Anna found out, shut down some government websites, and hacking attempts, according to the news, began forty minutes later. Ilnar believes that big companies will update while a huge tail of websites will remain vulnerable for a long time; a person could have found such a hole on their own, but few people spent resources on it, while an agent digs without needing motivation. Alexander fears that now anyone can take 5.6 Sol and scan practically any website: "these systems don't stop."
The second half of the episode is about tokens and limits. OpenAI's reset marathon has been going on for more than two weeks: OpenAI credited Alexander a thousand dollars in tokens for what it had undercounted, although he would rather have had his ten resets back, while Anthropic, he says, is "very strict" with resets. Dots is unavailable in Europe, and Anthropic has announced Claude Duet — an assistant that, like Dots, keeps working after the app is closed and reaches out to the person itself. Agents still lose recurring tasks: Codex stops doing what it had been doing, Anna reconfigures her chats every week or two, and Ilnar's context overflows after twenty to thirty hours. Ilnar, on the $200 Pro plan, is already seeing "the model is in too much demand" and is working more and more in Claude Code in parallel — as is Anna — while Alexander points out that when the limits run out, all the daily tasks stall, whereas Dots, unlike Anthropic's products, works independently of tokens.
Ilnar explains Anthropic's stinginess with resets by the pessimistic data-center investment scenario that Dario Amodei talked about: demand turned out optimistic, while new capacity will come in three or four years. Duet interests him more than Dots, but he believes it will have to be used in a cut-down way. At the end the hosts talk about how not to get lost in your own tasks: Alexander couldn't find a task he had dictated into Claude Code on the way home, and Anna gets by with rules for names and categories. Finally, Alexander is surprised by Sam Altman's comment on the Tesla flying car — "great Roadster, good job" — even though, as Alexander tells it, a year ago Altman had filed a refund request for his own Roadster.
The episode answers the question in its title without panic, but without reassurance either: what is dangerous, in the hosts' view, is not OpenAI's discovery itself — that hole has been closed — but the fact that it was found by a model that isn't the newest, from a one-line prompt, and that a huge tail of websites that haven't been updated will remain vulnerable. The rating of the vulnerabilities, the website shutdowns, the forty minutes before the first hacking attempts, the forty thousand accounts with undercounted tokens, the host's sixty billion tokens and Anthropic's investment in data centers — Ilnar doesn't remember the exact figure — are given as the hosts state them and need checking; Claude Duet had only been announced at the time of recording. The most practical steps are to update PHP or close the site until the update, give agents access with separate restrictions, compare their choices with your own and not keep your daily tasks in a single system.
Episode transcript
The episode is in Russian; below is an English reading guide to the transcript (the full EN transcript is a machine translation). Voice matching applied to 187 segments: 187 identified, 0 mixed, 0 probable, and 0 unresolved.
Read transcript on a separate page
Loading…