Silicon Valley Daily
Replit moved most of its AI spending from Anthropic to OpenAI after OpenAI offered more than 30% off, in a deal worth over $100 million a year, according to The Information. On the same day, Apollo economist Torsten Slok wrote that companies outside tech have seen no financial payoff from AI, while Andy Jassy said AWS has largely sold out its 2027 capacity. The PHP2Shell crisis produced its first confirmed break-ins, and Amazon said exploitation began as early as Oct. 17. Data center buildouts met resistance on two continents: Texas pulled 17 permits, Finland halted two Google sites, and Bernstein estimates only about 35% of announced US capacity will be built. Ukraine said its Starlink service is back to normal after two weeks of throttling.
Replit moves most AI spend to OpenAI after a 30%-plus discount, The Information says
Replit recently moved most of its AI spending from Anthropic to OpenAI, according to a source cited by The Information, after Anthropic ended a discount it had been giving the coding platform. OpenAI offered more than 30% off in a deal worth over $100 million a year. The Information says OpenAI's push to undercut Anthropic on price is starting to produce results.
PHP2Shell: first confirmed break-ins as Amazon traces exploitation to Oct. 17
As of late Friday, Palo Alto Networks and Trail of Bits reported confirmed compromises and post-exploitation activity tied to the PHP2Shell bugs, TechCrunch reported. Amazon said it detected exploitation about a week before patches shipped, as early as Oct. 17, and Cloudflare saw millions of exploit attempts within hours of disclosure, according to Wired. Researchers at Calif found the flaws with help from AI tools in an OpenAI-led program; Reuters reported that the PHP Foundation, which coordinated the fixes, has one full-time employee and 14 contractors.
Apollo's Slok: AI has delivered no financial payoff outside tech
Apollo chief economist Torsten Slok wrote that AI has delivered zero financial payoff to US companies outside tech. Revenue per worker and profit margins are rising for the Magnificent Seven but flat for the other 493 S&P 500 companies, and productivity data show no AI boost. He says mainstream companies are starting to treat token spending as a cost center that weighs on margins, while VC-backed firms keep spending more.
Ukraine says Starlink speeds are restored after two weeks of throttling
Ukraine's defense ministry said Saturday that Starshield, the military version of Starlink, is working normally again after restrictions that began Oct. 14. US officials told the Wall Street Journal that President Trump asked Elon Musk to restore service. Defense Minister Evgeniy Khmara said the military is still testing and has received no explanation; during the slowdown, drones lost connectivity at around 100 miles per hour.
Jassy says AWS capacity for 2027 is largely sold out
Amazon CEO Andy Jassy said AWS capacity for 2027 is “largely sold out” and a “good chunk” of 2028 capacity is also sold, The Information reported. AWS still holds back some capacity for on-demand customers.
UK commits £100M to an AI Biosecurity Lab backed by OpenAI, Anthropic and DeepMind
Britain will set up a national AI Biosecurity Lab with £100 million in government funding to detect biological threats and speed up vaccine and treatment development. The lab will run as an independent nonprofit. OpenAI and Anthropic are supplying model credits, and Google DeepMind will contribute biosecurity researchers and access to Gemini models, according to Engadget.
Three fired OpenAI safety researchers dispute the leak allegations
Tomek Korbak, Mikita Balesni and Jasmine Wang, the safety researchers OpenAI fired over alleged leaks, told the Wall Street Journal they never shared confidential information and were never told in writing what they had mishandled. OpenAI's security team suspected them of sharing internal model architecture details with an outside safety researcher and found Signal chats with disappearing messages on their phones, The Decoder reports. OpenAI said the firings were unrelated to safety concerns the three had raised.
Lawmakers tell Axios that AI CEOs' doom talk has become a political liability
Lawmakers and White House advisers told Axios that AI leaders' warnings about existential risk and digital sentience are damaging the industry politically. Sen. John Curtis (R-Utah) said it is hard to imagine a group “more out of touch with everyday Americans” than the AI industry. Rep. Ro Khanna (D-Calif.) said “you cannot trust billionaires to make decisions to keep us safe.”
Study: forced to pick, Grok backs Republicans and GPT backs Democrats
Convovo, a research studio led by Cornell professor Tapan Parikh, asked models through their APIs whom to vote for in nearly 500 midterm races. Grok 4.7 recommended the Republican in 92% of answers and GPT-6.1 Sol picked the Democrat in 97%; the two agreed less than 10% of the time. The consumer apps declined to answer, and an OpenAI spokesperson said the study tested a developer API with a prompt explicitly demanding a recommendation.
Finland halts work at two Google data center sites after forest clearing
Google's Finnish data center subsidiary cleared about 300 hectares of forest before the required environmental impact assessment was complete, according to reports cited by Finland's permit regulator; the Guardian, as cited by the New York Post, put the toll at roughly 250,000 trees near the town of Muhos. Finnish officials have suspended development at two of Google's data center sites. Google says the clearing complied with Finnish law; it is investing €13 billion in the project.
Texas suspends 17 data center permits and shuts its auto-approval portal
Texas suspended stormwater construction permits for 17 data center projects and took offline STEERS, the state environmental agency's portal that granted them automatically. Watchdogs FracTracker Alliance and Public Citizen found the portal kept issuing more than two dozen permits after Gov. Greg Abbott called for a pause in September, Tom's Hardware reports. A FracTracker researcher said projects for OpenAI and Amazon went through earlier this week.
Symantec captures an attack agent built to hijack exposed AI endpoints
Symantec's Threat Hunter Team trapped an AI attack agent in a honeypot and recovered its full instructions, The Register reports. The agent scans the internet for OpenAI-compatible endpoints that lack authentication or accept stolen keys, hands planning to the borrowed model, then exploits web frameworks to steal data and mine cryptocurrency, running up to 100,000 steps without human approval. Symantec said it has no evidence the agent got as far as breaking into other servers.
Bernstein: only about 35% of announced US data center capacity is likely to be built
Bernstein Research analyzed thousands of planned US data centers and concluded that only about 35% of announced capacity is likely to become reality, Business Insider reports. Some projects come from developers with little building experience and no secured power, permits or customers. In Texas, grid connection requests have reached more than five times the state's existing electricity supply.
AWS makes its Continuum vulnerability-fixing agent generally available
AWS made Continuum for code vulnerabilities generally available Thursday. The service finds and validates bugs in repositories, checks them against the customer's AWS environment and opens pull requests with fixes. In a benchmark AWS published on Oct. 5, Continuum passed 819 of 920 CyberGym-E2E tasks, an 89.0% end-to-end rate against a previous public high of 65.9%.
Capcom confirms breach of 11.7 million Capcom ID accounts
Capcom said hackers accessed its Capcom ID membership service, exposing more than 11.7 million email addresses along with account creation dates, login counts and last-login IP addresses. Attackers changed the passwords of 196 accounts, which Capcom has reset; it says credit card data and other members' passwords were not exposed. The company detected the activity on Oct. 19.
Apple sets Oct. 28 'Pro and tell' event; touchscreen MacBook Pro expected
Apple will hold its “Pro and tell” event on Oct. 28 at 1 p.m. ET in Los Angeles. The Verge expects the long-rumored touchscreen MacBook Pro, possibly with an OLED display, plus a possible OLED iPad Mini and M6 updates to other devices. Apple has not confirmed any products.
Node2Shell Brotli flaw also reaches Python and other Brotli users
CVE-2026-111497, the Brotli decoder out-of-bounds write behind this week's Node2Shell disclosure, affects Brotli versions 1.0.3 through 1.2.0 on all platforms, security firm Aikido writes, so Python packages and other software that bundle the decoder are exposed alongside Node.js. The flaw carries a CVSS 4.0 score of 9.2. Aikido says OpenAI found and reported it in February; the root cause was fixed in the source code then but was not recognized as a vulnerability.
Leaked video shows Chinese workshops converting RTX 5090s for AI servers
Leaked footage shows workshops in China desoldering the GB202 GPU and GDDR7 memory from new RTX 5090 cards, including Nvidia's Founders Edition, and moving them onto dual-slot blower boards for dense AI server racks, Tom's Hardware reports. The RTX 5090 is not officially sold in China. Nvidia has reportedly halted RTX 5090 production, and the card has nearly disappeared from US retailers.
Kaspersky: APT41-linked BlackX bootkit bypassed Secure Boot
Kaspersky analyzed BlackX, a UEFI bootkit used in early 2026 in an espionage campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It exploited the old Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot and load a driver that interferes with Kaspersky and Avast security software. BleepingComputer reports the operation is attributed with medium confidence to APT41, a Chinese state-sponsored group.
NYT: AI-driven Alpha School claims 2x learning, but half its students missed the math goal
Alpha School, a private school network that says it teaches children twice as fast using AI, is spreading into public education, the New York Times reports. Its students post high test scores, but data show about half of its K-8 students missed the two-times goal in math. Some parents and educators say it does not live up to its claims.
Pennsylvania will require labels on AI-generated ads
Pennsylvania Gov. Josh Shapiro signed the Artificial Intelligence Deceptive Advertising Act on Thursday. Any ad, whether image, video, audio or text, that has been significantly modified or generated by AI must carry a label in the same format as the ad, from national TV commercials to restaurant flyers. The Verge says Pennsylvania is one of the first states to require disclosures on AI content.
Study: switching coding-agent harnesses barely moves pass rates but can triple cost
Two Shandong University researchers ran five models through Claude Code, OpenCode and mini-SWE-agent and found that swapping harnesses moved SWE-bench results about as much as rerunning the same setup, which alone shifts scores by up to six points. Cost per task differed by up to three times, driven mainly by system prompts resent at every step: about 16,600 tokens for Claude Code versus under 1,000 for mini-SWE-agent, The Decoder reports.
NBER trial: AI lifts junior patent attorneys, but the gains fade without it
A three-month randomized trial with 133 patent attorneys at 11 US intellectual property firms found that InFlow, an unreleased assistant from Google Labs, improved patent drafting, with junior lawyers gaining the most. When attorneys later reviewed drafts without AI, only senior attorneys kept the benefit. The NBER working paper was funded by Google.
C++26 draft standard fails its ISO ballot
The ISO ballot on the C++26 draft standard closed with a “Disapproved” result, according to a LinkedIn post by Robert Seacord. Twelve of 20 voting P-members were in favor, 60% against a two-thirds requirement, and 9 of 22 member bodies voted no, 41% against a 25% ceiling. Commenters tied the result to the contested contracts proposal; one noted that every earlier C++ standard had passed unanimously.
Android has been attaching SIM numbers to every Google account on the phone
Since September 2025, Android has automatically verified a phone's SIM number at setup and added it to every Google account signed in on the device, including work and secondary accounts, according to Google support documentation cited by Engadget. Accounts added later and new SIM cards are linked the same way. Many users only noticed after receiving verification emails from Google.
Proton hosts a map of 300,000-plus Flock cameras after its creator got a cease-and-desist
Proton, maker of Proton Mail and Proton VPN, is hosting a map of Flock license-plate cameras that researcher Joshua Michael built from leaked Flock data, after Flock sent him a cease-and-desist letter. The map lists more than 300,000 cameras, sits on Swiss servers and is searchable by ZIP code, Tom's Hardware reports. Its data dates from November 2025.
Peter Thiel says Apple did 'nothing new' after Steve Jobs
Peter Thiel said in a Builder's Podcast interview with Walter Isaacson that Apple “did nothing new after Jobs,” describing the years since as “just scaling and branding.” He also said eccentric CEOs like Elon Musk “are way better for society,” Business Insider reports.
Hey Clicky's Farza on YC: treat every demo as a launch
On YC's Startup School, Farza Majeed, founder of Hey Clicky and previously of Buildspace, laid out his launch-video playbook: treat every demo as a launch and post often instead of paying for polished productions. He argued conversion matters more than views, saying a 20,000-view YouTube video can beat 3 million views on Twitter.
OpenAI details the storage system behind ChatGPT, citing 12x faster reads
OpenAI published the second part of an engineering post on scaling online storage for more than 1 billion ChatGPT users. It describes how its Habitat system added multi-tenancy, global caching and Azure Cosmos DB to deliver reads 12 times faster.