The AI vs AI Battle for the Internet

Full analysis

Two things happened this week that matter to anyone running AI in production, and only one of them is the shiny thing. The shiny thing is Claude Duet, Anthropic's proactive personal agent built on Opus 5.5. The thing that should move your week is php2shell: a critical PHP flaw found by GPT-5.6, affecting the servers behind an estimated 70% of websites, exploited by AI agent swarms that went from thousands of attempts to millions within hours of disclosure.

This is a news briefing, so the frame is simple. The personal-agent race is easy to react to and easy to ignore, because it's waitlist-only and nothing is locked in. The cyber story is hard to undo once it hits your stack. You don't get to decide whether AI-accelerated attacks exist. You only decide how fast you patch and rotate keys. That's what sets the deadline, and the deadline is "now," not "next quarter."

The Skeptic

Strip the drama off the cyber story and the mechanism is still real, which is rare. Mike Shelby's "biggest destruction event to the Internet in 20 years" and Aaron Levy's "100x more tokens" are fear quotes from people who sell security tokens and security software. Discount them.

But the Cloudflare numbers from Matthew Prince aren't vibes. Thousands of exploit attempts before disclosure, millions within hours. That curve is new. What changed isn't the vulnerability, PHP has had bad ones before. What changed is that attackers no longer need humans to weaponize a disclosure. The gap between "patch announced" and "mass exploitation" collapsed from days to minutes. If your patch cadence assumes a weekend, you're already late.

The Builder

Forget Duet for a second. The two breaches you should read closely are Railway and OpenCode, because they're about you, not a frontier lab. Attackers got into encrypted environment variables and pulled API keys to drain compute credits. If you store your OpenAI or Anthropic keys as environment variables, which is almost everyone, that's your setup.

Tuesday-morning work: rotate your model-provider keys, put spending caps and per-key limits on them, and check whether your hosting provider encrypts secrets at rest and who can decrypt them. OpenCode's Dax said the quiet part out loud: "The only reason we're surviving is because we have agents going 24/7." Translation: defense is now a machine-speed job too. A human on-call rotation can't watch a swarm.

The Researcher

The capability claim underneath all of this is the one worth checking: AI is now better than most humans at finding exploitable bugs. Anthropic's Project Glasswing, announced in April, gave partners a model called Mythos that reportedly found thousands of high-severity flaws across every major OS and browser. php2shell is that claim shipping in the wild, found by GPT-5.6 and independently by Wiz.

The fear framing misses something. The same capability that found php2shell early is why it got patched before disclosure. OpenAI coordinated the fix with PHP maintainers and Cloudflare two months ahead. Defenders found it first. The problem was a leak, roughly ten hours early, that let attackers start before everyone was patched. So the lesson isn't "AI breaks security." It's "AI compresses the timeline on both sides, and whoever's slower loses." Patching speed is now the whole game.

The Compute Pragmatist

Levy's "100x more tokens on security" sounds like hype, but run the economics and it's directionally right. If defense now means running models continuously to scan, triage, and patch, that's a standing inference bill, not a one-time scan. Security moves from a fixed cost to a metered one that scales with your attack surface. Budget for it.

And notice what Greg Brockman floated: government scanning the whole internet for vulnerable hosts and remotely patching them. That's a wild idea with real compute and real liability behind it. Someone pays for those tokens, and someone owns the blast radius when an authorized patch bricks a server. Don't expect that this year. Do expect your own defensive inference spend to become a real line item.

The Enterprise Buyer

Walmart is the move that gets missed. While Amazon, JP Morgan, and Bank of America are telling third-party agents to stay out, Walmart is opening the door: link your personal agent, set a spending limit, purchases need approval by default, agents that break the rules get banned. They're publishing the governance template before anyone else, and they have a reason. Their own Sparky agent drove order values 40% higher, and Meta says a quarter of Muse users already shop with it at a $200 average.

For a buyer, this is the contract language you'll be negotiating in a year: spending caps, approval-by-default, returns coverage when the agent screws up, the right to ban non-compliant agents. Walmart just wrote the first draft. Whoever controls the terms controls the checkout.

Where these collide

The tension worth naming: the labs are selling you two stories at once, and they point in opposite directions. Story one is NLW's framing that "we reached peak intelligence for most workflows" already, so the race is now about owning the user relationship, Duet versus Muse versus Dots. Story two is that these same models are getting dramatically better at a specific, dangerous task, finding exploits, which is the opposite of a plateau.

Both can't be casually true. If intelligence plateaued, php2shell shouldn't have been findable by GPT-5.6 but not GPT-5.1. The resolution is that "good enough for your calendar and your dashboards" and "good enough to find a decade's-worth PHP bug" are different capability curves. The agent layer has plateaued on convenience. The security layer has not. Builders should stop treating "AI is leveling off" as a reason to relax. On the attack-defense axis, it's accelerating, and that's the axis with a deadline.

Second tension: Brockman's authorized-defender idea versus everyone who runs their own servers. Government remotely patching your infrastructure solves the speed problem and creates a new one, who do you sue when the patch takes you down. That fight is coming, but not this quarter.

What it hinges on

One belief does the work: is the attack-defense timeline permanently compressed, or was php2shell a one-off that looks scary because it's fresh? The Cloudflare curve says permanent. The mechanism, attackers automating exploitation at machine speed the moment a disclosure drops, doesn't un-invent itself. So the thing to actually do this month isn't strategic. Rotate your model-provider keys, cap them, and find out whether your secrets are exposed in environment variables on a platform like Railway. That's the de-risking that matters, and it's cheap.

Prediction: Before the end of Q1 2027, at least one more AI inference or deployment platform in Railway and OpenCode's class will publicly disclose a breach involving stolen API keys or exposed environment-variable secrets used to drain model-provider compute credits.

Confidence: Medium. The attack pattern is proven, repeatable, and the target surface is nearly universal.

Why: Railway and OpenCode both described this as a coordinated campaign specifically hunting AI inference providers, and the economics are obvious: stolen keys convert directly into free compute the attacker resells or uses. Nearly every AI-hosting platform stores customer API keys the same way, in environment variables, so the attackers already know the pattern works and where to point it. The opposite outcome, zero further disclosures, would require either that defenders hardened faster than attackers can scan, which this week's Cloudflare numbers argue against, or that victims stay silent, which platform companies under security-disclosure norms and customer pressure rarely manage for long. The pattern repeating is the base case; it stopping would be the surprise.

Revisit by 2027-03-31: We're right if a named AI hosting, inference, or deployment platform discloses a key-theft or secrets-exposure breach tied to compute-credit abuse between now and then. We're wrong if no such platform discloses one in that window.