Daily LLM Briefing: Thursday 22 October 2026
Good afternoon. Today AI models help uncover one of the worst PHP flaws in years and OpenAI proposes a playbook for what comes next, a startup ships a laptop coding model it says AI largely built, Google's CEO puts numbers on Gemini 4 Argon demand, Nvidia adds open retrieval models for agents, and Mistral and Nvidia plan open benchmarks for engineering AI.
LEAD: Frontier models helped find "PHP2Shell", and OpenAI proposes a five-stage disclosure plan
Background: PHP is the language behind WordPress, Drupal and Wikipedia's MediaWiki, and Wiz says it powers about 70% of websites. In August, a researcher at security firm Calif, working in OpenAI's "Patch the Planet" open-source security programme, used GPT-5.6 Sol to find a serious flaw in PHP's core engine. Wiz found the same problems independently using its own tooling plus Gemini 4 Argon and GPT-5.6 Sol.
What happened: On 21 October PHP shipped fixes (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two remote code execution flaws, rated up to 9.2 out of 10 for severity. Wiz says every PHP version back to 5.4 is hit by at least one of them, and that the models were key to chaining the flaws into working exploits in hours, work that was "at the edge of what human researchers could practically achieve". Cloudflare says sites behind it already have firewall rules in place. Alongside the fix, OpenAI published a five-stage plan for AI-found bugs that affect many products at once: confirm and fix (including pointing frontier models at the patch to hunt for bypasses), give distributors and hosts a head start, bring in government responders (for PHP that included CISA and the White House), widen the circle, then publish guidance. OpenAI says it has found several other significant bugs and expects findings like this to "increase sharply in the coming months", and it's asking the security community for feedback.
Why it matters: It's the clearest real-world case yet that today's models can turn decade-old, hard-to-exploit bugs into practical attacks, for defenders and attackers alike. Anyone running PHP should patch now, and disclosure timelines are likely to get shorter and more coordinated.
Sources: OpenAI, Wiz Research, Help Net Security, The Decoder
Recursive's Flint: a free laptop coding model it says was largely built by AI
Background: Recursive, led by former Salesforce chief scientist Richard Socher, came out of stealth in May with $650 million at a $4.65 billion valuation. Its goal is AI that can improve AI.
What happened: On 21 October it released Flint, its first model: a mixture-of-experts coding model with about 40 billion parameters, of which only 2.5 billion are used for each token, free on Hugging Face under the Apache 2.0 licence. Recursive says its automated research system, the "Eureka Machine", helped with nearly every step, from pre-training to inference, including low-bit training that shrank the model by 71% with almost no quality loss, letting a small team build it from scratch in under four months. In Recursive's tests it runs at about 131 tokens a second on an M4 Pro MacBook Pro, roughly twice similar models, beats other sub-50-billion-parameter models on SWE-Bench Verified, and trails only Qwen3.8 27B on its six-test average. The company admits it needs more guidance than paid coding assistants.
Why it matters: It's a fast, private, offline coding model anyone can run, and an early public test of AI doing much of the research behind a new model, with humans still overseeing. The benchmark numbers are Recursive's own.
Sources: TechCrunch, The Neuron
Pichai: Gemini 4 Argon handled almost 25 trillion tokens in 72 hours, and Google is short of capacity
Background: Google released Gemini 4 Argon more widely in recent weeks, and Alphabet's heavy spending has pushed its free cash flow negative.
What happened: In a Sources interview published 21 October, Sundar Pichai said Argon processed almost 25 trillion tokens in its first 72 hours, about three times what Gemini 3 handled in the same window last year. He said Google is running into capacity limits serving it and that more efficient versions are in development to widen access. He also said Google is bringing always-on agent features to consumer Gemini over the next few months, and explained DeepMind's leadership change: Demis Hassabis has stepped back from day-to-day leadership and Koray Kavukcuoglu has taken over.
Why it matters: Even Google can't serve its newest model as widely as it wants, which suggests cheaper, lighter Gemini 4 variants are on the way and that compute, not just model quality, is setting the pace.
Sources: Sources with Alex Heath
Nvidia releases open retrieval models so agents waste fewer tokens searching
Background: Agents answer from whatever evidence they can find. Poor search means repeated lookups and extra tokens, so the embedding and reranking models behind search matter a lot.
What happened: On 21 October Nvidia added new open, commercially usable models to its Nemotron Retriever line: Nemotron 3.5 Embed in 8B and 1B sizes (plus a 4-bit 1B version), Nemotron 3.5 Rerank 8B, and Nemotron 3.5 Parse, a 631-million-parameter document extractor. The new embedding models can search images of documents, such as tables, charts and schematics, alongside the text. Weights, data and training recipes are on Hugging Face, with hosting on Baseten, DeepInfra, FriendliAI and OpenRouter. Nvidia also announced Kumo, a family of open models for structured business data.
Why it matters: Better open retrieval is one of the cheapest ways to make enterprise agents more accurate and less wasteful, and these can be self-hosted.
Sources: Hugging Face (Nvidia), Nvidia blog
Mistral and Nvidia plan open benchmarks for engineering AI; Mistral Large 4 weights due end of October
Background: Mistral Large 4 ("Le Chonk") is Mistral's biggest model, in public preview, with about 1 trillion parameters (49 billion active), trained on 3,800 Nvidia Grace Blackwell GPUs in Europe.
What happened: On 21 October the two companies said they'll combine Mistral Large 4 and Mistral's physics models with Nvidia's simulation tools to speed up engineering design in aerospace, cars and chips. They'll also publish public benchmarks and open datasets to test physics models and agents that use engineering software, measuring whether results are technically correct, how long they take and what they cost. Mistral repeated that Large 4's weights are planned for release at the end of October.
Why it matters: Shared, reproducible tests for agents doing real engineering work are scarce. And an open-weight trillion-parameter European model would be a major new option for self-hosting.
Sources: Mistral, The Decoder
New benchmark: models still stumble when a problem quietly becomes much harder
Background: Many hard (NP-complete) problems have an easy twin that differs by one detail, such as colouring a map with three colours instead of two. A model that truly reasons should notice which side it's on.
What happened: A paper posted on 21 October introduces P2NPCBench: 12 problem families with 2,114 rewritten problem statements, reworded by an adversarial multi-agent system so models can't lean on familiar textbook phrasing. Across 12 closed and open models, every model did worse on the hard versions than their easy twins (35.4% against 63.8% solved on the first try). Giving ten times more time barely helped (28.5% to 31.9%), because failures came from wrong or crashing programs, not slow ones. Removing textbook cues also shrank the gap, suggesting part of it comes from recall rather than reasoning.
Why it matters: It's a useful reminder that strong benchmark scores can partly reflect memorised wording, and that extra thinking time doesn't fix wrong approaches.
Sources: Paper (arXiv 2610.30103)
Also worth a look
- Demis Hassabis told the Wall Street Journal he now thinks AGI could arrive within two to three years, down from three to five earlier this year. The Decoder