Week 43 Dispatch // A Key Numbered 4, Airline Seats, and the Front Door

10/19/26 – 10/25/26

The Open

Websites prove they’re real with a kind of digital ID. This week a researcher found that some of those IDs were built on secret numbers like 4 and 56, and he guessed them in under a second. The company that issued them, eMudhra, is leaving the business. Chrome, Firefox, Apple and Microsoft all cut it off within days.

That was one of several scares in about ten days. A flaw in PHP, the code behind roughly 69% of the websites whose language is known, let a stranger take over a site with one request and no password. The fix landed Wednesday, and attackers had been trying it four days earlier. A hosting company called Railway told every customer to change every password. A tampered AI tool copied passwords off about 49,000 downloads in under two hours.

Same week, JPMorgan, Bank of America, Citi, Schwab and Wells Fargo blocked or restricted AI agents that kept logging into customer accounts with the customers’ own passwords. Schwab says it stops them tens of times a week. One bank executive told Axios they can’t reliably tell an approved agent from a rogue one.

Over and over, the weak spot sat underneath the product, in whatever stores the passwords or vouches for the IDs. Nobody at the front desk was checking those. And the visitor was usually a machine behaving like a person.

Noise in. Here’s what cleared.

Find your signal.
— BG

Before the Jump

November 2, 1988, 8:30 p.m. A Cornell grad student named Robert Tappan Morris released a small program that slipped in through a debug door left open in an email program, a mistake in a lookup service, and computers that trusted each other too easily. The usual estimate is 6,000 of roughly 60,000 machines on the internet, though that was a guess. Whole networks unplugged themselves for days. Morris became the first person convicted of a felony under the Computer Fraud and Abuse Act, and the government funded the first emergency response team. Worth a minute while this week’s scares all trace back to one thing trusting another.

Sonic Companion

Bob Dylan, “Knockin’ on Heaven’s Door” (Spotify). It’s written from a lawman handing back his badge. Easy Sunday listen, slow enough to think it over and draw the lines yourself.

Word of the Week

Confused deputy (n.): A program with real authority that gets tricked into using it for someone who has none. Norm Hardy described it in 1988. His example was a program on a shared computer that was allowed to write to the billing file. A user told it to save its notes in that file, and it did, wiping the billing records. The program followed its own rules and still did the damage. Worth knowing because every AI agent holding your password is a deputy, and the only question is whose instructions it follows.

The Roundup

// Talent. Anthropic published a study of its own workforce. Juniors fell from 27% of technical hires to 9%. Engineers push 5x the code changes they did six months ago, agents logged 6x the hours of the people running them, and the agents sit idle about 80% of the time waiting on a human. The lab selling the replacement is already running the experiment on its own entry level.→ the humans are the queue

// Ideas. Greg Isenberg spent 48 hours in San Francisco and came back with a question that quieted half a dinner table: if a new model drops next month, does your company get better or worse? His point is that the AI model is swappable, and a company’s years of customer data and workflows are what’s hard to copy. Some software companies, he says, are really data companies in disguise. The model is the rental. The records are the house.→ better or worse?

// Money. Ken Griffin said Tuesday that AI is “almost certainly” in a bubble, then told people not to run for the exits. His tell was the chips: once there are more of them than anyone needs, rental prices can collapse, like an empty airline seat. He doubts five- or six-year-old chips keep earning today’s rates. I’d take that over the speeches, because a rental rate is a number somebody has to pay.→ the empty seat

// Business. Anthropic is set to file its public IPO paperwork as soon as Friday, aiming at about a $2 trillion valuation and up to $100 billion raised. Reported first-half revenue is $16.3 billion against an $80.7 billion net loss, most of it a paper revaluation, plus more than $600 billion in computing contracts it can’t cancel. Griffin’s bubble call and the filing landed in the same week. The loss is the headline. The contracts are the filing.→ ignore the loss, read the contracts

// Platforms. The bank story from the open, with receipts: JPMorgan, Bank of America and Citi are restricting outside AI agents, Morgan Stanley is blocking them, and most are moving to look-only access. Executives called the situation “horrifying.” Same week, a Visa pilot let a payments company’s agent pay an invoice through the front door. The agent was registered with Visa in advance and could only pay what the buyer had already approved. The fix on offer is an ID badge for the agent, because a human’s password was never going to be it.→ look, don’t touch

// AI. One person’s AI agents broke into the websites of more than 100 companies, John Deere, SharkNinja and Cummins among them. The security firm that tracked the campaign puts the cost at about $5 per attempt with roughly a 10% success rate, which works out to around $50 a break-in. The limit on attackers is how much AI time they can afford to buy, and that is a budget line, not a barrier.→ $50 a break-in

// AI. The scares from the open, one line each:

• PHP: a flaw rated 9.2 out of 10, no password needed, fixed October 21 for current versions. Older versions get no fix. The security firm Calif says it found it August 1 using AI tools anyone can use.
• eMudhra: eight digital IDs with secret numbers small enough to guess in at most 256 tries. Every major browser blocked them.
• Railway: attackers may have reached the stored passwords apps use to talk to other services. Every customer was told to change theirs.
• LiteLLM: a free AI tool was tampered with and copied cloud, AI and login credentials from about 49,000 downloads in roughly 100 minutes.
• ConnectWise: a stolen credential for a backup tool let attackers sign into the Microsoft email and files of 173 customer companies, per Huntress.

The targets sat one layer below the products: the vouching, the hosting, the backup, the download. One break-in at that layer opens hundreds of companies at once. The PHP flaw wasn’t new this week. Reading old code just got cheap.→ five doors, one hallway